December 2003 - cypherpunks-legacy

Re: FLT 800: From the Rumor Mill...But It Makes Sense.. (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 10:15 PM 9/1/96 -0400, Simon Spero wrote: >On Sun, 1 Sep 1996, Alan Horowitz wrote: > >> The Aegis ship in the Gulf wzs not in an exercise. It was in a war zone. >> >> If my memory serves, the Iranian jetliner had its squawker turned off, or >> broken. The officer in charge in the CIC had about ten seconds to decide >> if he was about to be locked-on by a missle. And no real information to > >I think it was actually a combination of a design flaw in the user >interface for the control system combined with a human error that led to >the radar officer confusing the airbus with an (F4?) a hundred miles away >that he'd previously clicked on. Isn't there just the tiniest bit of a double-standard here? If the ship was supposedly "justified" in firing on an airplane just because it _could_become_ a threat, and _could_ fire a missile at any moment, then why can't we turn this logic around and claim that an Iranian aircraft could view an Aegis as a ship which "could become a threat" and "could fire a missile at any moment." Generally, I'm not sympathetic to the Iranians; far from it. But I can smell hypocrisy a mile away and the US military's "logic" in this area is unbelievable. Jim Bell jimbell(a)pacifier.com

1 0

Free Speech and List Topics
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:19 AM 9/2/96, Mark M. wrote: >On Mon, 2 Sep 1996, James Seng wrote: >> ps: Sorry for the off-topic discussion. > >Cpunks is certainly not the best place to be discussing free speech. However, >the link between free speech and the spread of cryptographic technology is too >close to completely overlook. I think it is as good a place as any to discuss free speech. The issues surrounding Net censorship, Singapore, the CDA, Germany, the shutdown of Julf's server, etc., are central to our concerns. And, in fact, it is "cypherpunk technology" which will have a more lasting effect on these issues than mere talking about it in some "free speech discussion group" will have. More disturbing to me recently has been the steady increase in subscribers to this list who don't seem to value free speech very highly, who write of their own nation's censorship as valiant efforts to protect citizen-units from foreign devils, and, even more shockingly, from supposed defenders of electronic freedom who are now talking about the need for limits on anonymity. With friends like those... --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

Your password for BARRON'S Online
by webmaster＠online.barrons.com 17 Dec '03

17 Dec '03

Thank you for registering with BARRON'S Online! THE USER NAME YOU HAVE CHOSEN IS cypherpunks THE PASSWORD YOU HAVE CHOSEN IS cypherpunk Please remember that your user name and password are case-sensitive (i.e. Bsmith is different than bsmith) and you should enter them as shown above. Your user name is required in its exact form each time you want to use registered areas on our site (including the exact upper/lowercase combination). The same restriction applies to your password. Your user name and password will allow you to access all of the features of BARRON'S Online. The rest of this message contains information about using your password and user name on BARRON'S Online. You may find it helpful to save this message for future reference. WHAT HAPPENS NOW? 1. Return to BARRON'S Online (www.barrons.com) You can use your password and user name to log in to any part of the site that requires registration (such as the Table of Contents, this week's stories, Dossiers and Market Day, and so on). The first time you go to one of these parts of BARRON'S Online, you will be prompted to enter your user name and password. 2. If you ever forget your password, or need any registration-related information, just click on the REGISTER button from the BARRON'S Online gateway page to find the help you need. Welcome to BARRON'S Online... we look forward to seeing you again and again! BARRON'S Online Customer Service barrons-support(a)www.barrons.com

1 0

Silenced Machine Guns Are Safer Than TWA
by qut＠netcom.com 17 Dec '03

17 Dec '03

! "James A. Donald" <jamesd(a)echeque.com>, writes: ! >I heard on talk.politics.guns somebody say that in Sweden they ! >had banned knives with a sharp point at the end, and were going ! >to ban sharp knives altogether. I think he was just engaging in ! >hyperbole, that he really meant that gun control in Sweden was ! >unreasonably strict, but on reflection I am not sure. ! > ! ! In a survey conducted in Sweden a few years ago, 50% of Swedish ! households had access to guns (generally military service weapons ! and sporting shotguns). Guns are, however, licensed and regulated, ! and seldom used in crimes. Licenses for "personal protection" are ! almost unobtainable. At least one military officer was court martialed ! when his service revolver was stolen from his automobile. ! ! The most significant "mass murderer" crimes in Sweden (one last ! year and one in the 1970's) were caused by people who used their ! legally-obtained military weapons. Hundreds of thousands of private American citizens legally own machine guns, silencers, live hand grenades, .75 caliber machine guns, etc. Perhaps 40% or so of the populace lives in an area without significantly higher regulations concerning such than the federal, which is not that bad. There is no federal law making silenced machine guns substantially more difficult to purchase and shoot than ordinary handguns. The feds certainly don't require training or any other similar requirement. Contrary to popular fiction, ALL firearms have been permanently registered since the 1968 Gun Control Act. The media monopoly lies when they say the contrary. How many firearm crimes were committed by these hundreds of thousands of ordinary untrained destructive weapon owners with their destructive weapons in the entire span of 1980-1996? *NONE*! THEREFORE, everyone in Sweden and America should be allowed to own silenced machine guns without any greater than the usual restrictions. BTW, I muse that the issue of guns, drugs and censorship make an excellent litmus test for libertarians: either you support the legalization of, all of, or your a fake.

1 0

http://infinity.nus.sg/cypherpunks/
by qut＠netcom.com 17 Dec '03

17 Dec '03

Someone keeps asking for the filtered cypherpunks archive: http://infinity.nus.sg/cypherpunks/ It's filtered with hypermail and is lynx friendly. It's easiest to read by choosing the link to filter by subject.

1 0

Re: WARNING vIRuS!
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 31 Aug 1996 23:41:58 -0700, Alan Olsen wrote: >> There is a new and VERY dangerous virus called the HAZ-MAT virus! >This is the clueless kind of crap I expect pitched to AOL users and upper >level management. >The only way that you could obtain the effects described above is with Black >Magic and/or Voodoo. (And not even then.) > >I remember a similar hoax going around about 3-4 years ago about viruses in >image files. I guess nothing on the net is ever forgotten entirely. >Especially the urban legends and bullshit. You ever notice how that is? People *never* remember things like "You have to execute something to get a virus". They *always* remember something like "Good Times." Reminds me of the guy who said you could stick all sorts of sensitive data in README.TXT because you can be sure nobody will look in there. - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

PGPCrack for DOS
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There is now a DOS version of pgpcrack. It's available at http://www.voicenet.com/~markm/pgpcrack.html. - -- Mark PGP encrypted mail prefered. Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMipT5yzIPc7jvyFpAQE8Ewf+J7x0km0xcGZM32c4clmFJ5I9z/bAj6bL ryXS1BNDBbC72HuJWQPUeqDc0xEc6uyjCc0iytfBL0VqwjlLKCb7KZtxgP7gOlf6 T12/ZNQZwGy3PeClLthQRqQ0fjUtVs4mXWp+sDnAAClI6J+xEL/cBdHDD5tREngM ufDwueSAwFPQQE/adpS0E3alHj1XqdHMam5s60SGpsZyknnUhnUiAIc2w2CdmjJU 5jywEOosiMcbvYqhBaSuy3S53Pfjh07wEFfXp0t9CvvsJY13ipIW6jvgQgVYQL6u 0f1ob7CkwxiD/z598aXmmCc4Nmn0pFg9Zvqw9xLcs88s4GaGsH15gw== =zGl8 -----END PGP SIGNATURE-----

1 0

Re: hackers texts
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 01 Sep 1996 08:51:36 EDT, patrick b cummings wrote: >If any of you hackers out their have wrote any texts for beginning >hackers or know of any please send them to me at patrickc(a)juno.com You know, I think his mail server has a 36 hour delay on incoming messages. Either that or he's Roadkill on the Information Superhighway // \\ // \\ ______________ // \\ | | // \\ | Information | // \\ | Superhighway | // ____ \\ | 56MB/s | // /____\ \\ |______________| // |==__==| \\ | | // ~||~~||~ \\ | | // ' \\ | | // // \\ | | // \\ | | // / / \\ | | // \\ | | // /// \\ | | // \\ | | // . ,& \\ | | // . `;//* IS HERE \\ // . `|/^\@'< ' . | \\ // `_/x@=%$P/,', <---/ \\ // >@#)*?o$%( , \\ // \.X#j~\===B \\ / \\ : The Clue truck got him... [In case you haven't noticed yet, this looks best with a non-proportional font] - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: Moscowchannel.com hack
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 1 Sep 1996 10:09:32 -0500 (CDT), Igor Chudov @ home wrote: >> > Not really crypto, but related to the DOJ hack in a way. >> > >> > Moscow Channel is a pretty slick, Russian news/commentary >>page. Their Web >> > site was hacked and altered by someone who didn't seem to >>like Russians all >> > Just a matter of time before some builds a dedicated Satan >>type tool that >> > scans for HTTP server holes or messed up file permissions >>to make locating >> > potential victims easy. >> Write your web site to a CD-ROM and hard-code the base >>directory into the >> webserver. > >A hacker who has root can forcibly unmount the cdrom and mount >another >directory on that node. Not a good solution. Hack your system kernel to only allow mounting read-only media to that point. Most hackers wouldn't try "hot-patching" the system kernel. The ones that can probably have better things to do than hack your page. - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: Bob Dole on Drugs
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 1 Sep 1996 11:33:02 -0500 (CDT), Igor Chudov @ home wrote: >http://allpolitics.com/news/9608/31/radio.addresses/ > >... snip ... > > Dole, who returned to Washington for Labor Day > weekend, also pledged to use the White House as a > bully pulpit to promote the "moral message" > against drugs and to criticize what he called the > entertainment industry's glamorization of drug use. > > On Sunday, he is to address the convention of the > National Guard Association of the United States > during which he's expected to propose that the > military be enlisted to assist in a renewed war on > drugs. This actually makes a lot of sense; if you've decided on an all-out war on drugs, doing it right is *much* better than some sort of weenie effort like we've got. I liked Robert Heinlein on immigration "If we're going to stop immigration build a Berlin style wall complete with alligators in the moat. Otherwise give up the pretense; nothing is more expensive or less useful than a wall that isn't." (very loosely paraphrased) - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: Silenced Machine Guns Are Safer Than TWA
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:33 AM 9/2/96, Skippy wrote: >Contrary to popular fiction, ALL firearms have been permanently >registered since the 1968 Gun Control Act. The media monopoly lies when >they say the contrary. Nope. Gun sales between individuals without any paperwork were fully legal in some places until recently (and may still be fully legal...I can only speak of California). >From 1974 until a couple of years ago, I bought and sold a dozen or more rifles, handguns, and even Evil Assault Weapons, mostly through fully legal gun shows. I even sold a .357 Smith to some guy, made a joke about how great these gun shows were and how great it was to be able to just take cash and hand over a gun without any paperwork...the guy laughed and said he was a San Jose cop. I felt nervous for a few seconds, but quickly realized there was no law *I* was breaking, so I laughed too. Most of these guns I kept no records on, nor did any laws say I had to. (A few years ago it became necessary for even private citizen-units to obtain the proper firearms transfer papers from the gubment. I wanted to sell a laser-equipped Heckler & Koch SP-89 without creating a paper trail (as I'd not had one when I acquired the piece a few years earlier), so a friend of mine used his friendly neighborhood libertarian FFL dealer, who has a policy that the stack of transfer forms he is required to keep on file will mysteriously burn up if the Feds ever seek out his records. (Who knows if he'll abide by this policy, but the point is that there are literally tens of thousands of these "kitchen table FFL dealers," and no computerized filing of records. This is one reason I quit the NRA: they are advocating the "instant check." Such an instant check would mean massive computerization of all files, and of course cross-referencing to files on citizens. This would be much worse than the "paper chaos" of stacks of firearms paperwork sitting in dusty filing cabinets. I'll take a 10-day ineffectual waiting period to a Big Brother database of all purchasers.) >BTW, I muse that the issue of guns, drugs and censorship make an >excellent litmus test for libertarians: either you support the >legalization of, all of, or your a fake. I'm not sure what the "legalization of censorship" would mean, though I support the right of anyone to screen out what they choose not to read or view. And I support the right of companies to decide what materials to buy, have viewed by employees, etc. (So if the "Valley Lesbigays" want to show a tape at Hewlett-Packard, H-P can just say "Nope--we're not interested.) I fully support legalization of all drugs, all guns, and am unalterably opposed to any form of government censorship. Does this mean I pass or flunk the litmus test? (He said acidly.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

desubscribe
by Cyber Thrill 17 Dec '03

17 Dec '03

desubscribe

1 0

Re: Moscowchannel.com hack
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 1 Sep 1996 12:22:40 -0500 (CDT), Igor Chudov @ home wrote: >> > > Write your web site to a CD-ROM and hard-code the base directory into the >> > > webserver. >> > >> > A hacker who has root can forcibly unmount the cdrom and mount another >> > directory on that node. Not a good solution. >> >> Real hard disks such as RL02's & RK07's have WRITE DISABLE >> switches.... >> > >You can't mount the whole Unix read-only, so there will always be a place >to put the hacked web page, and then mount that place over DocumentRoot. If you had enough RAM in the machine, you could disable swapping, send all log files to /dev/nul (or /dev/lp0), run *only* a web server or anything else that can avoid writing to disk (probably no CGI, etc). It wouldn't be too interesting, but then you probably don't want much happening on your web server anyway. You could even wire that write-disable switch or jumper into a keyswitch on the main console. - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: Free Speech and List Topics
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:17 AM 9/2/96, qut wrote: >About the need for limits for anonymity, guess what brought that on? >Crime? Yes! The crime of the media monopoly violating the anti-trust >acts, because people are ignorant enough to trust the mass media for >their news. No self-respecting Cypherpunk thinks the Antitrust Act and related acts are worthy of enforcement. (Think of how the technology we support will tend to allow new avenues for price collusion, interlocking directorates, new forms of business combines, unreadable secure communications with foreign competitors, and so on, all things the Antitrust regulators are already growing worried about.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Encourage Singapore To Come Out Of the Stone Age
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:06 AM 9/2/96 +0800, James Seng <jseng(a)pobox.org.sg> wrote: >Just let to add my comment in regard to this unforuntate discusssion. >To understand the sitution better, you should not impose America >idealogy and perspection on how things to be done to Singapore. >Singapore maybe young but there are certain culture too. While Tim's article title was clearly intended to be provocative, I think the most unfortunate thing about this discussion is that we need to have it at all. Any government, or any individual thug, that would impose violence on people for saying things that would bring it into disrespect deserves no respect at all. Any government that claims to have the god-like wisdom to dictate what's best for its subjects to hear or what religious ideas to believe doesn't deserve to be listened to, much less obeyed. If Singapore's government and religious leaders want to say "Our ideas are better than American ideas", and you or I or your neighbor want to listen to them, fine; maybe some of their ideas are better than some of the many ideas floating around North America. But if you or I or your neighbor want to listen to competing ideas, and even to believe and talk about competing ideas, neither you nor the government have the right to stop them - only to refute them with better ideas. People like Tim and I aren't upset only because we believe that we know better than you and Lee Kwan Yew how to run Singapore; free speech is often threatened here in the US and especially Canada. You mentioned movie ratings - they were invented here partly to avoid the threat of government censorship. A few years ago a prominent right-wing religious/political leader, Jerry Falwell, put out a "Bill Of Rights For American Families" that included the right not to hear offensive foreign ideas like Communism. I agree that Singapore and America have different cultures; in an environment of free speech, if Singaporeans don't like American TV and movies, they won't watch them, and advertisers will quickly figure this out and try to find TV programs they like. On the other hand, if a power-hungry government decides that it doesn't like American TV, forbids business licenses to anyone who broadcasts it, and jails anyone who broadcasts TV without a business license, they're more corrupt than a government that forbids business licenses to anyone who doesn't pay a bribe. (At least in a kleptocracy, you can usually print or say what you want if you pay the bribes, though my father-in-law's newspaper was once shut down for printing that the mayor was taking bribes, and who they were from, and how much.) >In addition, you need to see the method of censorship deployed in >Singapore. For press media like papers and magazine, it is done in a >passive manner. They _do not_ read every issue of every magazine available >in Singapore. They only do so when there is enough complains. This also means you don't know what is safe to print and what isn't. You have to restrict yourself very strongly, because otherwise some politically influential person will complain to the government, and you go to jail. At least if the government tells you what the rules are, you know it's safe to say things that don't violate them. >One more point. They know it is impossible to censor everything. [....] >his reasoning is "how many people can do it? 10%? 5%? That's fine with us. >If the people really wans it, they can get it". Interesting. I don't know if this is good or bad, but at least they're realistic. It also means that if enough people want information badly enough, the government may know not to censor it. On the other hand, a government that can keep the leader of an opposition political party in jail for years just because he opposes them is pretty corrupt. >if you wish to rebuke the points which i mention above, please feel >free to do so but do so in the context wrt Singapore culture. >Do not impose the general idealogy and culture within >your country into your argument. The right to speak freely without government thugs shutting you down and throwing you in jail or killing you is a universal one. The ability to get anybody to listen to what you have to say, on the other hand, is highly dependent both on general culture and on the interests of the individuals you hope will listen, as well as on what you have to say and your ability to say it well. >Now, what makes you think that citizen of Country A has the power or >rights to tell politicians of Country B what to do and what they cannot do? >Just wondering. Because I have a mouth and a conscience, and they have ears and consciences. I certainly have more right to tell a politician in Country B not to stop his subjects from speaking than he does to order them not to speak. And if the politicians over here are wrong, which they often are, you've got the right to tell them that too. Of course, the politicians over here usually won't listen to you, and the politicians over there either won't listen to me or they'll add my name to the firewall killfile :-) But it's also safer for me to tell your politicians to behave well than for you to tell them, since you have to live with them. >ps: Sorry for the off-topic discussion. It's not off-topic. Building tools to prevent censorship is distinctly on-topic for cypherpunks, and an occasional digression into whether it's a good idea is worthwhile. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

2 1

free speech online
by patrickbc＠juno.com 17 Dec '03

17 Dec '03

I agree that their should be free speech on the net. Someone should start a petition and get as many people to sign it as possible.

1 0

Re: Pseudonym server: Jenaer Anonymous Service
by lutz＠as-node.jena.thur.de 17 Dec '03

17 Dec '03

* stewarts(a)ix.netcom.com wrote: > Jenaer Anonymous Service <anon(a)as-node.jena.thur.de> > looks like a high-security pseudonym server. Thanks. > rather than having it arrive directly. But in return, > it's pretty secure, since you can only get caught if the > remailer or its operator are compromised when you request a delivery. It's strongly recomment to use a reply server to forward your requests to. The server sends all outgoing messages via mixmaster chains. (mixmaster(a)as-node.jena.thur.de can is always the first one in the chain). The policy of this remailer urges the user to send incoming jobs only via mixmaster chains. It may be changed to drop incoming jobs which does not come from the local mixmaster silently. > I haven't yet checked if how flexible it is about the location > of Reply-To: in the headers, since some mailers make it difficult > to paste that in. Reply-To: is neccessary to be included in the encrypted message body. All readable header informations execpt Subject: {help,send} is drop to /dev/null including the To:, From:, Sender:, Path:, Reply-To: ... lines. > The public key for the server is signed by Lutz.Donnerhacke(a)Jena.Thur.De, > which is in turn signed by 0x3B7F286D, which MIT thinks is an unknown > signator... 0x3B7F286D is the key of Winfried Mueller, the maintainer and autor of Religio, an information system anout religious subjects. A lot of documents fight against Scientology. Try http://Www.thur.de/religio/. Type Bits/KeyID Date User ID pub 2048/39F37F5D 1996/04/25 Lutz Donnerhacke <Lutz.Donnerhacke(a)Jena.Thur.De> Lutz Donnerhacke <lutz(a)dana.de> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzGACKIAAAEIAMSu8OdG/ZNUiN1qc/eobx53oCeOW3iaxWIrK3q9XgBfzHwy AuwumYmL+mgCFnP7jkmk0Y4mst6UszujK+mplzuqzCox+7mUhBl0swQQ/0Bqg8HX 0lm0oYoTnQoeUMcoqCGcj1PbO8Gm40nlXj6wKHzhWQfIVkvhyzUODEhu/Pr0mf9V PtjVoWya8qD+LleM6u8GHsGP2bfERUfFDr6cmdtbUg24U/lsenYzzE5kW1VUyFqK YqRGJoDy1ZQlXIgVG6wULdNcJ96Vc2tEMRMWASvxxS9BJORUC0nRAE6sqBKXiQ93 +x06J3xEaSuCVv9DxyFl8HIQzOtzCdxwOTnzf10ABRG0MEx1dHogRG9ubmVyaGFj a2UgPEx1dHouRG9ubmVyaGFja2VASmVuYS5UaHVyLkRlPokBFQMFEDG9XE/4w3ah osUXSQEBgeoH/iA1uhqU3RsqebIgJquaTB2e5m9NfZdD108ctmhbf191IodV+Doz oWAp9GH9PMhD/vEERoiuwNJCGGCUDooaRXR4ZRh6I8Tb4D+C53uiPqaNKdzjaZTi gQ3I/odRwpoggWqr5d8SjIG4Hf5ERB39wdMSrzmHpXYJJRdLvVh9tYFhmS1islDB vAUxAVlnWKk1vLkbn4cSuIrZL53HQ60fBfcK9MVAPelHhi4jh1J3JN8NJk8bsht6 lx5BfdygLN5Mn4FEQ0JveH2kH2xmSoQvHuAjo1YzBJePOoyJgfJ/QcwNx7ZAcewC HvaogTeALtt0n11q67/1PNOq3/5D+CMqB8iJAJUDBRAxgT1EYH38Rzt/KG0BATIr BACijD0IjjePaO0ZVU2zk+OChpXmztf512PwIf6nRcdlOC+DtoK/EusXJoUx2lmb 8M8sJiaN9PgCOj21QfbpkEcyCCXdKfpBvtj5g73OruJdSCFV+O9Pts8jEqlTK+zo we/Rqr/Nd08Sh0dkQ8E0hlpUVgQkGUiBs5T8LNSeV9G8LIkBFQMFEDGACKMJ3HA5 OfN/XQEB/+QH/20sSVx0VZyv6bbX4t37dd8uY0ZmY7ZxAkwTFZD9wgmcpCQ11cTY 2ZiAKZFheSo4HirBtdKKmW9jMl2GuOs/yDT3JUEcFLSdsFEeqy3EzDYCpJDlm+pV Vd1BidO3phnt6mqbHoKVbwD0+SL6ZxvRzUscnLL3fEDuIepJ4RGlTH6K8cfooDi3 AI6SBPlphO92ZEeVYs/MRCziwhyYHBAZ3ldJJR23V2vlRaB8LO/UhtcZ8aAHXBi2 XbML4sI4qVqvWEeDLe42lAEmlzgm9zzzvjeBHUe2h8kUU/p0KWhnBbRBDLIuoY4Z lEogVqB2bzYFZ17IWQtsy7VS7X9IcxERg6m0H0x1dHogRG9ubmVyaGFja2UgPGx1 dHpAZGFuYS5kZT6JARUDBRAxhoKJCdxwOTnzf10BAS90CACENM1MPBE4vg9sm7Bq t7PyUCrO4z0ZGjiVQhAe1e2nzXAWqYbNhg7tpla/eekG146KBq9h7KFd2v3qApyR cosse0KUiuLEiCNne7wnwgHpe0+g5DEMmqqqkInaErxyDLEa12YVcwWkaESQyJD8 B5pgRyf4G1SuDRnhOL1VY3SaZeo8trzwWWFLapPI4Qy6vzm2/LdtprL52pFuTD3J f591mHnnIo3FsYEuMBJUxFYw91dO2RfqSQmqCnR7v4B5IE2OElXZZy8co2rHy969 2IM32oJyRJVbj/U3M+EqOSvhsFmqU6muEUkfvNyknyCGyt1hdATSb4QzwPdMKXRC YTRi =LDb+ -----END PGP PUBLIC KEY BLOCK----- > Because you don't get your reply email until you ask to pick it up, > it does seem easy to abuse; complaints, flames, and mailbombs won't reach you > if you don't ask for them. I hope the operator doesn't mind the workload > of managing the remailer - it looks like a good service, and with > Julf's remailer shut down, we need more nymservers. Sure. My nymserver is completely written as a bash script. -- | Lutz Donnerhacke +49/3641/380259 voice, -60 ISDN, -61 V.34 und Fax |

1 0

Undeliverable Message
by MAILER-DAEMON＠mqg-smtp3.usmc.mil 17 Dec '03

17 Dec '03

To: <cypherpunks(a)toad.com> Cc: Subject: Re: It is good that anon.penet.fi has been closed! Message not delivered to recipients below. Press F1 for help with VNM error codes. VNM3043: BANYAN SERVER@MAG26@2DMAW NEW RIVER VNM3043 -- MAILBOX IS FULL The message cannot be delivered because the recipient's mailbox contains the maximum number of messages, as set by the system administrator. The recipient must delete some messages before any other messages can be delivered. The maximum message limit for a user's mailbox is 10,000. The default message limit is 1000 messages. Administrators can set message limits using the Mailbox Settings function available in the Manage User menu (MUSER). When a user's mailbox reaches the limit, the user must delete some of the messages before the mailbox can accept any more incoming messages. UNDEFINED-----BEGIN PGP SIGNED MESSAGE----- On Sun, 1 Sep 1996, Igor Chudov @ home wrote: > I believe that Private Idaho is a cypherpunks remailer client for Windows. True. But it is a seperate program from email clients which means that anyone wanting to use Private Idaho has to download it, install it, and learn how to use it in conjunction with one's email program. Most people who may have a need for anonymity have probably never heard of PGP or Private Idaho. I think that until remailer functions are actually built into the programs that people use, remailer use will be rare. - -- Mark PGP encrypted mail prefered. Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMipNqizIPc7jvyFpAQFy0Qf+LbMgy3PBJ+ipGbxblKbjEm09aiziLEpD p7JCudf6TrBUdF+2PwTdxK/sOCITE9lTwbycAgeCvEYNUJEbsR3a6ix5fxbQuF8p Y9/tEbLVESUz0/+UthVnBasbFsCOzHV+ztlIRIk8SEEJKxsu8cNRZqcjaAqH5Q1A dmBKZ9KGQWPNuc5oLfqahyzroa8kAG59HSDm+ntV9fwduKNi8wSV6WFmA2s9pnZa +yRRXmSm4PkWVXgNdQCosTTcD1enSIBcH2WAQu1jpDZbbs6+6v1KvdPa5+WOvTs3 kpBfFBlsmVkWJS63ouqDb7yihoq/qZvhyE2Fske8uVYh9M5Ffn9AKg== =md6D -----END PGP SIGNATURE-----

1 0

Undeliverable Message
by MAILER-DAEMON＠mqg-smtp3.usmc.mil 17 Dec '03

17 Dec '03

To: <cypherpunks(a)toad.com> Cc: Subject: Re: DON'T Nuke Singapore Back into the Stone Age Message not delivered to recipients below. Press F1 for help with VNM error codes. VNM3043: BANYAN SERVER@MAG26@2DMAW NEW RIVER VNM3043 -- MAILBOX IS FULL The message cannot be delivered because the recipient's mailbox contains the maximum number of messages, as set by the system administrator. The recipient must delete some messages before any other messages can be delivered. The maximum message limit for a user's mailbox is 10,000. The default message limit is 1000 messages. Administrators can set message limits using the Mailbox Settings function available in the Manage User menu (MUSER). When a user's mailbox reaches the limit, the user must delete some of the messages before the mailbox can accept any more incoming messages. UNDEFINED-----BEGIN PGP SIGNED MESSAGE----- On Mon, 2 Sep 1996, James Seng wrote: > Now, what makes you think that citizen of Country A has the power or > rights to tell politicians of Country B what to do and what they cannot do? > Just wondering. I have every right as a citizen of country A to tell politicians of country B what they should or shouldn't do. This isn't about American Ideology; it's about natural rights. Politicians of country B can refuse to listen to me or attempt to prevent my corrupt ideas from polluting the minds of its citizens, but they won't succeed very well with the latter. Of course, politicians may be satisfied with making sure that only the most determined citizens will be able to access information they don't want citizens to access, but as technology progresses, it will become much more difficult to prevent this information from spreading to the masses. > > ps: Sorry for the off-topic discussion. Cpunks is certainly not the best place to be discussing free speech. However, the link between free speech and the spread of cryptographic technology is too close to completely overlook. - -- Mark PGP encrypted mail prefered. Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMipSASzIPc7jvyFpAQFYyAgAuy7FvTpGHqYHi9zw3FMiea2tLnYVWPU6 D6VrGvN5NxRtTE8yW3eKrc1iU/0jQIVxHtUhHcodbPfvGqEtwuZKKbbknNj5GmzS pmhcYPguXDwlXL4m3IjxEvhPg7GZ7tjbhXlPK7ADu0EHxvjwesAcrKyCPddu0i9U e83bo3Q4vBT75WPVpSI1i6jJmC7ql4s3GZVvP2Qf6hzvu9fwSKbAra0ZLBFVKf25 WKwNK2eTVBcQOYytwXOQmdSV/hgFB/Y2T6+PHgnAjaDVeX3WqUuxggk6DpBY2V8g bORwsuZyweJviVZIOjbLx6RDeNJQWWSjUCojHvJyKzqffg23Fi8bAw== =+23m -----END PGP SIGNATURE-----

1 0

Re: It is good that anon.penet.fi has been closed!
by Bill Stewart 17 Dec '03

17 Dec '03

In a challenging article posted 12:33 PM 9/1/96 -0500, ichudov(a)algebra.com (Igor Chudov) wrote: >Yes, subject says it all. anon.penet.fi was a whole lot worse than >cypherpunks remailers. It provided clueless users with no real security, >because it stored return addresses and did not use chaining and >encryption. There are different reasons people use remailers, different amounts of security they need, and different levels of security that the remailers can provide. Anon.penet.fi was a Good Thing. It got a few hundred thousand people thinking about remailers, and why they want them, and thinking they were good tools. It helped the public learn that anonymity is useful for real people, and helped the public learn that they can't always believe an email message is from the "person" on the From: line, and that email and news postings aren't always authentic just because they come out of a computer :-) One way to provide privacy is through heavy mathematics; for some people, and some threats, you need that. Another way to provide privacy is through a trusted operator who's willing to put up with a lot of crap to provide the service. For many people, that's enough - not for people worried about eavesdroppers and overthrowing governments, but enough for people talking about their attitudes toward work and sex and drugs who don't want their email traced by their employers, nosy neighbors, or local vice cops. And part of this security is the willingness to close down a popular service when it's security is threatened. One feature that's really needed for many remailer applications is reply addresses. Doing that securely with cypherpunks-style remailers is hard; doing it securely with trusted-sysop remailers is much easier, and even then there were occasional bugs, and plain surprises. In general, anything that knows the return path is vulnerable; if the person sending the reply knows the destination address, which doesn't apply to many of the applications, the remailer system in between can be secure, but otherwise you're not "truly secure" - only "pretty good". Knowing what the users really want to do helps you do it more securely. >From what I know of remailer history, the main original goal of the cypherpunks-style remailer was to provide security against traffic analysis by eavesdroppers, rather than to prevent the recipient from knowing the sender's address, though everybody pretty quickly realized that the latter was an interesting feature, especially coupled with posting to Usenet. Learning the differences between what people will really do with 2-way remailers as opposed to 1-way remailers can be done better with an easy-to-use 2-way remailer like penet.fi which can get 500,000 (possibly duplicated) users than with moderately complicated systems like alpha.c2.org or the really complicated things that may be needed to get better security. >Maybe closing of anon.penet.fi will spur real interest from the unwashed >alt.sex.* masses to the truly secure remailers. Who knows; maybe the most effective way to fund "truly secure" (bwah-hah-ha) remailers will turn out to be to carry phone sex advertising :-) Or maybe somebody will build a decent digicash interface to a remailer, which will help get digicash going now that everybody who uses remailers will be looking for a new home. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

Re: It is good that anon.penet.fi has been closed!
by Bill Stewart 17 Dec '03

17 Dec '03

In a challenging article posted 12:33 PM 9/1/96 -0500, ichudov(a)algebra.com (Igor Chudov) wrote: >Yes, subject says it all. anon.penet.fi was a whole lot worse than >cypherpunks remailers. It provided clueless users with no real security, >because it stored return addresses and did not use chaining and >encryption. There are different reasons people use remailers, different amounts of security they need, and different levels of security that the remailers can provide. Anon.penet.fi was a Good Thing. It got a few hundred thousand people thinking about remailers, and why they want them, and thinking they were good tools. It helped the public learn that anonymity is useful for real people, and helped the public learn that they can't always believe an email message is from the "person" on the From: line, and that email and news postings aren't always authentic just because they come out of a computer :-) One way to provide privacy is through heavy mathematics; for some people, and some threats, you need that. Another way to provide privacy is through a trusted operator who's willing to put up with a lot of crap to provide the service. For many people, that's enough - not for people worried about eavesdroppers and overthrowing governments, but enough for people talking about their attitudes toward work and sex and drugs who don't want their email traced by their employers, nosy neighbors, or local vice cops. And part of this security is the willingness to close down a popular service when it's security is threatened. One feature that's really needed for many remailer applications is reply addresses. Doing that securely with cypherpunks-style remailers is hard; doing it securely with trusted-sysop remailers is much easier, and even then there were occasional bugs, and plain surprises. In general, anything that knows the return path is vulnerable; if the person sending the reply knows the destination address, which doesn't apply to many of the applications, the remailer system in between can be secure, but otherwise you're not "truly secure" - only "pretty good". Knowing what the users really want to do helps you do it more securely. >From what I know of remailer history, the main original goal of the cypherpunks-style remailer was to provide security against traffic analysis by eavesdroppers, rather than to prevent the recipient from knowing the sender's address, though everybody pretty quickly realized that the latter was an interesting feature, especially coupled with posting to Usenet. Learning the differences between what people will really do with 2-way remailers as opposed to 1-way remailers can be done better with an easy-to-use 2-way remailer like penet.fi which can get 500,000 (possibly duplicated) users than with moderately complicated systems like alpha.c2.org or the really complicated things that may be needed to get better security. >Maybe closing of anon.penet.fi will spur real interest from the unwashed >alt.sex.* masses to the truly secure remailers. Who knows; maybe the most effective way to fund "truly secure" (bwah-hah-ha) remailers will turn out to be to carry phone sex advertising :-) Or maybe somebody will build a decent digicash interface to a remailer, which will help get digicash going now that everybody who uses remailers will be looking for a new home. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

Educating former anon.penet.fi users about other remailers
by Bill Stewart 17 Dec '03

17 Dec '03

I've gotten about 5 messages from daemon(a)anon.penet.fi telling me that the remailer is closed; don't know if they're from various previous identities, or if they're from postings to mailing lists with anonymous people on them, or whatever. If somebody were to put together a one-page note on other remailers, would it make sense to send it to all the penet.fi users? A canonical cypherpunks approach would be to just write one and send it to na000001(a)anon.penet.fi ..... na600000(a)anon.penet.fi, but I assume either my system or Julf's would decide it was spam and discard it (even if it were split up into 60,000 10-message chunks.) The press release on www.penet.fi does contain pointers to the FAQs, but people have to go looking for that. On the other hand, if there are an extra 10,000 hits per day on alpha.c2.org because of a really well-written one-page blurb, can it handle the load? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

Re: Encourage Singapore To Come Out Of the Stone Age
by James Seng 17 Dec '03

17 Dec '03

At 11:29 PM 9/1/96 -0700, Bill Stewart wrote: >bring it into disrespect deserves no respect at all. Any government >that claims to have the god-like wisdom to dictate what's best for >its subjects to hear or what religious ideas to believe doesn't >deserve to be listened to, much less obeyed. If Singapore's government >and religious leaders want to say "Our ideas are better than American >ideas", and you or I or your neighbor want to listen to them, fine; I think you have misunderstood my posting. I never say Singapore ideas are better than American ideas. What i am saying is that Asian (Singapore) values are _DIFFERENT_ from western (America) values. [i know i am generalising] When you look at the laws and regulation. You cannot just look at what you think is best. You have to look at other things. Culture, social and economical structure, religion and history. In every aspect, Singapore (or most Asian for that matter) are different. Thus, you cannot judge a Singapore government action based on your social background. My purpose of posting is to hope to bring some light to the people here about some social norm in Singapore, hopefully to explain why the government choose to block certain WWW and yet was not strongly opposited here. Secondly, you do not need to convience me. I agree with you totally. What you have to convience is the general population here, against the culture, the society and everything. >maybe some of their ideas are better than some of the many ideas >floating around North America. But if you or I or your neighbor >want to listen to competing ideas, and even to believe and talk about >competing ideas, neither you nor the government have the right to >stop them - only to refute them with better ideas. Nope. I am open to ideas which is why i been watching to this thread. I find it is rather constructive to see how people think about Singapore and then compare it with my own ideas. However, i also know it is useless to have continue discussion with fanatic as they have a tendancy to distored what you say to suit their argument. Nor are they particular open minded to listen to others like our dear Tim has clearly shown us. This is why i am responsing to your article and not his. >On the other hand, if a power-hungry government decides that it doesn't >like American TV, forbids business licenses to anyone who broadcasts it, >and jails anyone who broadcasts TV without a business license, >they're more corrupt than a government that forbids business licenses to >anyone who doesn't pay a bribe. (At least in a kleptocracy, >you can usually print or say what you want if you pay the bribes, >though my father-in-law's newspaper was once shut down for printing >that the mayor was taking bribes, and who they were from, and how much.) Sad to say, Singapore government does have a lot of power. But i am glad what you mention isnt happening in Singapore. I havent heard of any serious corruption cases or people accepting bribes etc. Nor does the people here feel a suppressed nor are there general disatifaction. I think you are too influenced with the persepection from 1984. *8) All things works both ways. Power is no otherwise. >This also means you don't know what is safe to print and what isn't. >You have to restrict yourself very strongly, because otherwise >some politically influential person will complain to the government, >and you go to jail. At least if the government tells you what >the rules are, you know it's safe to say things that don't violate them. You dont go to jail for writing articles. You might be sue for deframation if you published something untrue (similar to your civil lawsuit i guess?) and have to pay large sum of money to the person but you dont go to jail. And yes, they are telling the people what _are_ the things now so you know what to avoid. >It also means that if enough people want information badly enough, >the government may know not to censor it. On the other hand, >a government that can keep the leader of an opposition political party >in jail for years just because he opposes them is pretty corrupt. I am not interested in politics so i didnt really know what is happening in that case. for that, i have no comment. >The right to speak freely without government thugs shutting you down >and throwing you in jail or killing you is a universal one. >The ability to get anybody to listen to what you have to say, >on the other hand, is highly dependent both on general culture >and on the interests of the individuals you hope will listen, >as well as on what you have to say and your ability to say it well. Very true. So does the First Amendment said. Singapore does have such similar law as First Amendment which is slight "modified". You have freedom of speech as long as your comments does not endanger religious/racist harmony and national security. (I do not know the exact term..need a lawyer for that..). The reasons for this are for historical reasons which trace back. >Because I have a mouth and a conscience, and they have ears and consciences. >I certainly have more right to tell a politician in Country B not to >stop his subjects from speaking than he does to order them not to speak. >And if the politicians over here are wrong, which they often are, >you've got the right to tell them that too. Of course, the politicians >over here usually won't listen to you, and the politicians over there >either won't listen to me or they'll add my name to the firewall killfile :-) >But it's also safer for me to tell your politicians to behave well than >for you to tell them, since you have to live with them. Fair enough. Point taken and you are right. I was able to say that you are not the one who are going to vote for/against them in the next election. *8) >It's not off-topic. Building tools to prevent censorship is >distinctly on-topic for cypherpunks, and an occasional digression into >whether it's a good idea is worthwhile. Perhaps but not to the other thousand of other cypherpunk subscribers. With this, i hope i have explained any misunderstanding with the previous posting. If you wish to carried on with this discussion, please feel feel to email me directly. -James Seng

3 2

More child pornography nonsense
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

> webslingerZ > _________________________________________________________________ > POLICE SEARCH INTERNET FOR CHILD SEX ABUSERS > __________________________________________________________________________ > Copyright &copy 1996 Nando.net > Copyright &copy 1996 Reuter Information Service > STOCKHOLM, Sweden (Aug 31, 1996 00:11 a.m. EDT) - Police across Europe > widened their net Friday to track down a pedophile network which is > spreading increasingly to the hard-to-detect Internet, while at an > international conference, Southeast Asia was cast as a major > destination for child sex tourists. > At the World Congress Against Commercial Sexual Exploitation of > Children, which has attracted over 1,000 delegates to Stockholm from > 130 countries, campaigners outlined measures to crack down on > pedophiles' use of the Internet. > Norway's ombudsman for children, Trond Waage, said to date there was > very little action that could be taken to stop the distribution of > child pornography on the Internet. > But he said the establishment last week of an international body to > monitor child pornography on the net, a task taken on by the Norwegian > branch of Save the Children, was firm action against pedophiles using > the net. > "This is a kind of a cybercop," Waage told reporters. > "We need some visible cops on the net. If you undertake these kinds of > criminal activities someone will monitor you." > Save the Children will try to monitor any child pornography on the > Internet and is encouraging other net surfers to pass on information > that will be handed to the police. Want to bet how fast they'll be mail-bombed? Cops on the net are _not_ popular, no matter what they're doing. This fact is especially true when there's no actual harm taking place (unlike, say, spamming) - the harm has _already_ taken place by the time the material is on the Internet. Should we ban films with violence because they _might_ be snuff films? -Allen

1 0

Re: wardialer
by pjn＠nworks.com 17 Dec '03

17 Dec '03

> Does any body know where I can get a half decent war dialer. > In> Use a websearch utility, and stop posting to cryptography-based In> mailing lists. Someone should shoot that kid and put US out of OUR misery... :) P.J. pjn(a)nworks.com ... Nothing is opened more often by mistake than YOUR mouth. ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: DON'T Nuke Singapore Back into the Stone Age
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:06 AM 9/2/96 +0800, James Seng wrote: >that). I have a long argument with this person, telling him that despite >what they have done, i could still access to those stuff which they ban. >his reasoning is "how many people can do it? 10%? 5%? That's fine with us. >If the people really wans it, they can get it". The flaw with this view is that it is no harder to deploy software that defeats Singapore's proxy than it is to establish a tcp/ip connection in the first place. For civilians (such as myself) establishing a tcp/ip connection is as hard or as easy as establishing an encrypted tcp/ip tunnel to defeat government control efforts. For both these tasks, I am dependent on software writers who know more than I do. Since the software of the Net is written by people not governments, the governments will find it hard to hold "free users" down to a 5% or 10% figure. The Net is nothing more than the software that it runs on and we (not governments) write the software. In addition, we are not imposing our ideology on Singapore. If Singapore changes, it will be because an encounter with the realities of the free flow of information changes it. DCF

3 2

"Always make new mistakes"
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Esther Dyson sigfiled: ... > Esther Dyson Always make new mistakes! OK, but must we always be trying to make the same *old* ones, only in a new medium? <sigh> At least there's still EPIC (for now, I'm wondering when _they_ decide to cave?). I'm feeling pessimistic. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy & Weekend Winsock Wemailer Opewator. "Whoever would overthrow the liberty of a nation must begin by subduing the freeness of speech." -- Benjamin Franklin Defeat the Duopoly! Stop the Browne-out! Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMirUhG1lp8bpvW01AQHR3QQAl9EvaUOCHnTZ0eyIa+kv41fXDJMsOC0v BUGKvnz3rfVxRTS3JiHALB93Kc1F+kSjoOd7ftM42Pod4bsreSAHJ0CInJ2Q8iYS r7Y2/opiY139YonF4WsD6IPTMA2Hfip9t8EACu0v2jIvxSCBqwa84WVrAxCijS9t qfKK8d3Xw9g= =6tBV -----END PGP SIGNATURE-----

1 0

The AI-who???
by Robert Hettinga 17 Dec '03

17 Dec '03

An admittedly leftist interpretation of recent Alaskan electorial events, for those fans of the Alaskan Independance Party... Cheers, Bob Hettinga --- begin forwarded text From: sxaeg(a)aurora.alaska.edu (GREENWALT ART E) (by way of rah(a)shipwright.com (Robert A. Hettinga)) To: rah(a)shipwright.com Subject: The AI-who??? Organization: University of Alaska Fairbanks Path: news-central.tiac.net!news-in.tiac.net!uunet!in3.uu.net!brighton.openmarket.com!decwrl!news.alaska.edu!aurora.alaska.edu!sxaeg Newsgroups: alt.culture.alaska Date: 29 Aug 1996 01:07:38 GMT Lines: 35 NNTP-Posting-Host: aurora.alaska.edu X-Newsreader: TIN [version 1.2 PL2] X-Newsreader: Yet Another NewsWatcher 2.1.2 Okay, okay...I know everyone has been sitting on the edge of their privy seats wondering how the Rent-A-Party (aka "The Sub-Arctic Titanic of Politics") fared in the recent primaries here in the Interior, so here goes. Now, keep something in mind as you read these results: the Interior is the heart of the Rent-A-Party. Der Fuhrer Vogel "graced" us with his presence and as the infirmities of advancing age took their toll, he devised the party back in the mid-70's here in the Interior. So...you should think the bastion, the stronghold, Yea, Brethren and Sistren!, the very for-r-r-r-rtress of AIP-ity would be...the INTERIOR! Amen! The AIP fielded 1 candidate here on the Fairbanks ballots: Paul Chizmar. He finished last. Indeed, surpassing even the last performance of the party when they dropped from their 1990 high of 39% of the vote to their 1994 basement 13% of the vote, we now see them seeking subterranean levels as their sole candidate on the entire ballot received *barely* 11% of the vote! Right here! In the Interior! Just about 15 miles from Lynette and Dexter Clarke, the penultimate-Grand Poobahs of Das Partie! Tsk.... I tell ya, folks...I love to watch "Rocky and Bullwinkle", "Monty Python", "The 3 Stooges", the "Little Rascals", etc. But when the AIP finally dwindles/splinters/transmogrifies into its final bit of light and then that little glimmer goes out....I will have lost one of my greatest sources of amusement Alaska has ever offered me. Sigh.... .....Art, who will just have to watch more 3 Stooges and see if he can tell which one is Joe... --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (cyber mix) The alpha and nymrod nymservers are down due to abuse. However, you can use the cyber nymserver. The nym.alias.net server will be listed soon. See http://www.cs.berkeley.edu/~raph/n.a.n.html for details. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. Hopefully, this is fixed by now. The penet remailer is closed. Last update: Mon 2 Sep 96 6:45:14 PDT remailer email address history latency uptime ----------------------------------------------------------------------- mix mixmaster(a)remail.obscura.com -+++++-+++++ 1:38:18 99.98% jam remailer(a)cypherpunks.ca .*****-+**+* 28:42 99.98% exon remailer(a)remailer.nl.com ***--**+**** 3:33 99.98% squirrel mix(a)squirrel.owl.de +-+------.+ 2:37:06 99.96% cyber alias(a)alias.cyberpass.net +-+*+** 38:49 99.96% middle middleman(a)jpunix.com ---- --+++ 55:25 99.69% replay remailer(a)replay.com +* *-**+*** 6:15 99.36% amnesia amnesia(a)chardos.connix.com - -----+--- 3:24:36 99.35% lead mix(a)zifi.genetics.utah.edu +++--+-+++++ 48:39 99.23% winsock winsock(a)c2.org - -----+-- 5:46:31 98.94% balls remailer(a)huge.cajones.com # **-**+**** 5:32 98.70% nemesis remailer(a)meaning.com ****- ++**** 23:48 98.46% extropia remail(a)miron.vip.best.com -..------ 4:55:14 94.02% haystack haystack(a)holy.cow.net *#* ##+### 10:59 90.11% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: PLEASE Nuke Singapore Back into the Stone Age
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:51 PM 9/1/96 -0700, Timothy C. May wrote: >Who says this has anything to do with "American ideology"? The Usenet is >propagated around the world. All we are saying is that honest commentary on >the corruption of Lee Kwan Yew (and his billion dollars in Australian and >European banks) will be reported on the Usenet. > >This is not "imposing American ideology" on anyone. Didn't you know that TCP/IP was an attempt by American Intelligence Agencies in concert with Britain to impose Anglo-American values (free trade in goods and bits) on the poor Mittel Europeans and the followers of Confucius in the East. These sinister British-American conspirators had done so well with their earlier releases of blue jeans, Rock and Roll, and Coca Cola. TCP/IP was designed to be the final blow to Central Europe and Asia in a culture ware that has dominated this century. Pretty sneaky those Anglo Saxons. DCF "Course if Mittel Europeans and Confucians hadn't murdered 100 million people or so in the 20th century, perhaps we could feel sorry for them." (The US-UK alliance only murdered a few million mostly via mass bombing of civilians during WWII.)

1 0

Re: Los Angeles Times article on Helsingius and anon.penet.fi
by edyson＠edventure.com 17 Dec '03

17 Dec '03

At least you don't accuse me of being a Communist. For the record, I am not a tool of the CIA nor have they pressured me, but there's no reason for you to believe me. Esther Dyson At 08:23 PM 9/2/96 +1000, Julian Assange wrote: SNIP --- > >Examining in detail Dyson's interests it appears she maintains a >sizeable and long-standing interest in Eastern European technology >companies. She is also clearly very far to the right of the political >spectrum (rampant capitalist would be putting it mildly). She also speaks >Russian. I'm not saying she has been working for the CIA for the past >decade, but I would be very surprised if the CIA has not exerted quite >significant pressure (which they are easily able to do given the >location of many of Dyson's assets) in order to bring her into their >folds during that time period. > >-- >"Of all tyrannies a tyranny sincerely exercised for the good of its victims > may be the most oppressive. It may be better to live under robber barons > than under omnipotent moral busybodies, The robber baron's cruelty may > sometimes sleep, his cupidity may at some point be satiated; but those who > torment us for own good will torment us without end, for they do so with > the approval of their own conscience." - C.S. Lewis, _God in the Dock_ >+---------------------+--------------------+----------------------------------+ >|Julian Assange RSO | PO Box 2031 BARKER | Secret Analytic Guy Union | >|proff(a)suburbia.net | VIC 3122 AUSTRALIA | finger for PGP key hash ID = | >|proff(a)gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 | >+---------------------+--------------------+----------------------------------+ > Esther Dyson Always make new mistakes! EDventure Holdings <edyson(a)edventure.com> 1 (212) 924-8800 1 (212) 924-0240 fax 104 Fifth Avenue New York, NY 10011 USA www.edventure.com High-Tech Forum in Lisbon, October 27-29, 1996 PC Forum in Tucson, Arizona, March 23-26, 1997

3 2

Terrible story on crypto in InfoWorld
by C Matthew Curtin 17 Dec '03

17 Dec '03

There's a story covering crypto in this weeks' InfoWorld Electric. Since it's a members-only thing, I'll include the text here, as well as my response to it. I'm hoping that they'll take the article down and take up my offer to provide a better replacement. I suspect that the problem here is that someone was given a subject and a deadline, and told to "go for it." The requisite background for getting clued on crypto is probably significantly longer than the amount of time allowed by the deadline. I suspect that the issue was further clouded by the crypto-clued people she talked to during the research speaking directly about what they're doing, without giving any sort of analogies to make the ideas click and make sense. I hope that my illustration of the bicycle lock serves to clear up the confusion... In any event, we've all got a lot of work to do. I think we should take it upon ourselves to not only talk about crypto and why it's such a Good Thing(tm), but also to *educate* people to help them understand what in the world we're talking about. -matt ------------------------ begin silly article ------------------------- [Image] [PageOne] [Search] [Reader Service] [Ads Services] [Overview Map] [Todays News Logo] [Opinions] [Forums] [Test Center] [Calendar] [This Week In Print[Week In Review] Encryption technology can help secure private data over public carriers, but tackling its own issues is another story By Julie Bort InfoWorld Electric Think about this: Every time one of your end-users sends an electronic communication from your network, it opens the door to an attack. It is unbelievably easy for a knowledgeable hacker to exploit the failings of SMTP and other communications protocols to eavesdrop on Internet e-mail, send phony messages, or even gain access to other networked systems, security consultants say. A domain name or single IP address is the only information needed, and from there the door is wide open for other mischief. One increasingly popular way to plug this gaping hole is to encrypt e-mail and other electronic communications. Encryption is a way to encode text using complex mathematical algorithms. "When explaining encryption, I like to use the analogy of the Cap'n Crunch Super Secret Decoder Rings. These rings [distributed in Cap'n Crunch cereal boxes in the 1960s] contained a very simple algorithm. It was something like `take a letter then add 5.' So an A became an F. Simply speaking, that's all these algorithms are, mathematical formulas," explains Gary Fresen, a member of the American Bar Association's committee on digital signatures and an attorney and partner at Baker McKenzie LLP, in Chicago, one of the world's largest law firms. Although no encryption algorithm is in and of itself crack-proof, several of them are so complex that they are virtually unbreakable. Coupled with proper implementation, authentication, and secure connections, encryption solutions can add a high level of security to any company's arsenal. However, it is an area that requires a knowledgeable person to make the purchasing decision because the technology is very complex, the best product selected will add a level of administration overhead, and numerous industry consortiums are developing competing APIs. NUMEROUS USES. Is encryption security overkill? Absolutely not, say users who have already adopted it or are in the processing of adopting it. One reason is to gain some security control over public telecommunications lines used in wide area networks. "We have a good idea of our internal security, but we also use the public carriers for our worldwide WAN, such as CompuServe [Inc.'s] frame relay and British Telecom [Plc.'s] frame relay, and we [don't control] their level of security," says Richard Perlotto, corporate network security manager for VLSI Technology Inc., in Tempe, Ariz. "Even if you own most of your own equipment, with frame relay you don't own the router, the carrier does. Frequently [the carrier has] modems attached to those routers to manage the equipment remotely," Perlotto adds. Those modems can allow hackers to tap in and grab data as it is being transmitted, without ever being detected by the company's security systems. Consequently, VLSI is currently evaluating encryption boxes and other products that sit on either end of a connection, such as NetFortress from Digital Secured Networks Technology Inc. (DSN), in Englewood Cliffs, N.J. One box encodes all traffic on the fly when it's being transmitted, and the other decodes the information upon receipt. Router vendors offer similar add-ons. Besides simply letting employees sleep better at night with the knowledge that their corporate secrets are safe, encryption technology can mean that a company can operate more efficiently and cost-effectively, users say. "Right now, we drop letters into the post office, which isn't very secure when you think about it," Fresen says. "After all, anyone could look at them. Or we send a courier. But if we can secure our [Lotus Development Corp.] cc:Mail system, there's a tremendous cost savings to us compared to sending a courier to Hong Kong three times a day. And we'll be able to do things in a day that used to take a week." Fresen is currently testing Entrust 2.0 from Northern Telecom Ltd. (NorTel), in Research Triangle Park, N.C., as an encryption add-on to e-mail. GETTING KEYED IN. But before you can go out and purchase an encryption system, you need to do some serious homework. Encryption involves multiple technologies, competing protocols, and complex mathematics. You can start the learning process by understanding the two components that make up most encryption systems: the key and the certificate. The key is the algorithm or mathematical formula that encodes the message itself. It must be sent to the message recipient so the message can be decoded, hence the term key. The size of the key, measured in bits, determines how complex the algorithm is and how tough the code is to crack. The state of the art for encryption technology used exclusively within the United States is 1,024 bits. However, the maximum size key that is allowed to be exported is 40 bits. Keys come in two flavors: symmetrical, or public key model; and asymmetrical, or public key/private key model. A symmetrical key uses the same algorithm to encode and decode a message. This is the technique used by the public key encryption program Pretty Good Privacy (PGP). PGP assumes what security experts call the peer trust model. That is, the sender knows and trusts the receiver and is therefore perfectly comfortable in sending the key on its way. Herein lies the "pretty good" part of the privacy. Although the algorithm itself makes the message difficult to crack, the key exchange is only pretty good when compared with other methods. On the other hand, the great advantage to PGP is that it creates no key management overhead, which is the biggest drawback of asymmetrical keys. In the asymmetrical model, users have a public key stored somewhere that is available. Should someone want to send an encrypted message, the sender locates the public key of the recipient, encodes the message, and sends it off. The receiver then uses a private key to decode the message. The private key is different from the public key, but they are mathematically linked so that the private key is capable of decoding the message. Asymmetrical systems require no trust between the sender and the recipient. That's good. But they do create administration overhead in the form of storing and maintaining public and private keys. Public/private key exchange is the technique used by RSA Data Security Inc., which was recently sold to Security Dynamics Inc., in Bedford, Mass. RSA uses a technology that is actually an adaptation of the decade-old National Institute of Standards and Technology's peer-trust Data Encryption Standard (DES), still used in many products. DES is a method of grabbing random keys for each encryption task, rather than using the same key repeatedly. Cryptographers say that RSA solves some problems, such as the trust issue but generates others. "Say I want to send a secure message. The first thing I do is take a random key and encrypt the message with it," says Paul Kocher, an independent cryptography consultant in Menlo Park, Calif., and one of the people responsible for discovering the flaw in the security of Netscape Communication Corp.'s Netscape Navigator. "But without that key, I won't know how to decode [the message], so I take an RSA public key and encrypt the random DES key with my recipient's public key. The recipient uses a private RSA key to decrypt the DES key. If it sounds convoluted, it is. RSA is very slow and cumbersome. DES is fast and efficient, but it doesn't give you the security of the public/private key system," Kocher explains. RSA remains one of the most well-known encryption technologies, but it is not, by far, the only public/private key exchange method currently in use. For example, other vendors use a competing version called Diffie-Hellman. It is a mathematically different implementation of the asymmetrical model, and it is the method employed by DSN's NetFortress. THE REAL YOU. Using public or public and private keys is the foundation of encryption, but keys can't verify a recipient's identity. "When you're talking about sending secured messages, there are two goals you've got. One is to make sure that the information stays confidential, and the other is that it does not get tampered with," Kocher says. Enter the certificate, also called the digital signature. Certificates act like an electronic driver's license. They authenticate that the receivers and senders are who they say they are. "The issue is trust. When we owned our own 3270 cabling, we trusted it, we worried less. Now I have someone at Daytona Co. that needs access to Chrysler Corp. across multiple networks. What sort of trust do I have?" asks Bob Maskowitz, technical support specialist for Chrysler, in Detroit, and a member of the Internet Architecture Board of the Internet Engineering Task Force (IETF). "I need to authenticate that this person is allowed to update [a document]." Certificates can be created and managed by a third party, such as VeriSign Inc., in Mountain View, Calif., or they can be created and managed internally, with products such as NorTel's Entrust, which also performs encryption. Once a certificate is obtained, it becomes the user's digital signature. When digitally signing something, the recipient of the signature gets all of the information contained on the certificate, such as who the person is, the person's address, or other items chosen to be included on the certificate. The digital signature also says who granted the certificate, when it expires, and what level of verification was done. "There are three classes of certificates," explains Gina Jorasch, director of product marketing for VeriSign. "In Class 1, we check for a unique name, that the e-mail address is correct, and that the person receiving it has authority to access that e-mail account. In Class 2, we check the name, address, driver's license, social security number, and date of birth. For a Class 3 we check all of those things, plus we check against the Equifax [credit reporting bureau] database." Although certificates provide the invaluable service of authenticating users, organizations that care enough about their security to use encryption and certificates may not want to trust an outsider to handle them, according to users. "Do you think Ford [Motor Co.] or Chrysler is going to let someone else control their certificates? Then there is this issue of where did you get your certificate from? Am I going to let you query my database to get a key? No way," Maskowitz says. From a network management perspective, certificates are also an issue. Unless they are outsourced, they will add a significant amount of system management overhead to an encryption system, even with systems such as Entrust that include management features. Most certificates are set to expire in a set amount of time, such as a year. Someone will have to see that they get reissued. Someone will also have to make sure that certificates for employees who leave a company are revoked and that new employee certificates are issued. SMIME'S THE WORD. The final area of concern IS managers face is the new wave of protocols being spewed out by various industry consortiums. Numerous APIs are being created that cover all the aspects of using encryption. Although these APIs are posing as standards, in truth the two most popular APIs for the commercial sector are merely vehicles for the mass adoption of a particular company's key technology. Nevertheless, vendors of products such as e-mail packages are lining up behind them. The four big protocols being worked on are Secure Multipurpose Internet Mail Extensions (SMIME), Multipart Object Security Standard (MOSS), the next-generation version of PGP that allows asymmetrical key exchange, and Message Security Protocol, says Rik Drummond, chairman of the IETF's electronic data interchange over the Internet committee and president of The Drummond Group, a consultancy in Fort Worth, Texas, that helps corporations choose and implement networking and security systems. MOSS is the API for the Department of Defense, and it will be mandatory for anyone in the government or anyone who does business with it. But commercially, SMIME and PGP, Version 3.0, are more robust choices, Drummond says, and they offer features best-suited for the commercial sector, such as backward compatibility, and better key and certificate management capabilities. By far the biggest names in the Internet world have lined up behind SMIME, including Microsoft Corp., which intends to make Microsoft Exchange SMIME-compliant; Netscape; and Qualcomm Inc., maker of the Eudora e-mail package. That makes it a comforting set of protocols to choose because corporations that buy products with SMIME or that purchase SMIME toolkits for customer applications will know that they will be able to communicate with the vast majority of others through a de facto standard. Those using other protocols will be left talking to themselves. Still, SMIME, as it stands now, isn't a panacea. Among its problems is that "the signature is exposed outside the encryption envelope," Maskowitz says. Also, once a message is encrypted with someone else's public key, the sender of the message can't open the message to make changes, Maskowitz adds. The architects of SMIME haven't completed the APIs yet, so there is some possibility that these problems will be fixed but in all likelihood not in time to be included in the first crop of SMIME-compliant applications, due to start rolling out this fall. Even with such serious issues still up in the air, today's encryption and certification products can offer a great deal of protection, especially if the Internet or a wide area intranet is becoming a serious business tool for a particular organization, and it can't wait for a de facto standard to emerge. For those with the time to wait, the learning curve should be ascended now. Mass adoption of encryption technology is a virtual certainty. Those that ignore it will find their secrets being blabbed to the world. -------------------------------- Uses for encryption technology: * Sending sensitive data over publicly owned wide area links; * Sending sensitive data over Internet e-mail; * Electronic commerce; * Electronic data interchange over the Internet; * Order entry/order status over an intranet or the Internet; * Automated access to personnel files; * Storing sensitive data online; * Distribution, newsgroup style, of sensitive data. -------------------------------- Will the export of strong encryption be allowed? One of the problems with adopting encryption worldwide is that the federal government severely restricts its export. In fact, encryption technology is classified as munitions. Therefore, U.S. encryption vendors and corporations are forbidden from exporting and deploying versions that use more than a 40-bit key. However, companies in other countries, such as Japan, can freely sell encryption technology that uses the tougher 1,024-bit standard. The U.S. government isn't completely closing its eyes to the matter. In July, Vice President Al Gore unveiled a proposal that would create a key-escrow system allowing keys greater than 40 bits to be exported but requiring a third party to keep a copy of a key that could be used by law enforcement officials. (See U.S. considers easing encryption export laws.) And this past June, the Senate Subcommittee on Technology, Science, and Space heard a slew of testimony from encryption vendors and other experts on the problem. In fact, there are several bills pending in both houses of Congress that would relax the current export restrictions. The Security and Freedom Through Encryption Act was introduced in the House by Rep. Robert Goodlatte, R-Va. Meanwhile, The Encrypted Communications Privacy Act of 1996 was introduced in the Senate by Sen. Patrick Leahy, D-Vt., and the Promotion of Commerce On-Line in the Digital Era Act of 1996 also sits before the Senate. All three laws would relax the 40-bit restriction on keys as well as eliminate other restrictions on international use and development of encryption. Officials of U.S. corporations look forward to these changes and believe that such changes would improve their ability to compete in the international marketplace. "We're an international company, so we can't use the domestic version of Netscape [Communications Corp.'s Netscape Navigator]. And we can't trust the data using the international versions," says Richard Perlotto, corporate network security manager at VLSI Technology Inc., in Tempe, Ariz. Julie Bort is a free-lance writer based in Dillon, Colo. Please direct your comments to InfoWorld Electric News Editor Dana Gardner. [Image] To respond to this review, go to the forum. [Image] [Image] Copyright © 1996 InfoWorld Publishing Company ------------------------- end silly article -------------------------- --------------------------- begin response --------------------------- -----BEGIN PGP SIGNED MESSAGE----- This references http://www.infoworld.com/cgi-bin/displayStory.pl?960830.crypt.htm Hi, First of all, I'd like to commend InfoWorld for covering a very important topic: cryptography. There are, however, some very significant flaws in the story, which I hope will be corrected soon. As the article exists now, the information is sufficiently incorrect to be more harm than if the article didn't exist at all. Anyone using it as a guide will be only further confused. The quotes are indented two spaces, with my comments below... Although no encryption algorithm is in and of itself crack-proof, several of them are so complex that they are virtually unbreakable. Coupled with proper implementation, authentication, and secure connections, encryption solutions can add a high level of security to any company's arsenal. However, it is an area that requires a knowledgeable person to make the purchasing decision because the technology is very complex, the best product selected will add a level of administration overhead, and numerous industry consortiums are developing competing APIs. Also, there are a lot of people who simply don't know what they're doing when it comes to cryptography and security. Many products claim high degrees of security, but are hardly strong enough to keep someone's kid sister from deciphering the message. The key is the algorithm or mathematical formula that encodes the message itself. It must be sent to the message recipient so the message can be decoded, hence the term key. Bzzzt. The formula is the algorithm. The key is a piece of data (often times, a passphrase, or a relatively small file) that is fed to the algorithm along with the data to be encrypted or decrypted to produce the desired result. The idea being that if an attacker knows what algorithm someone is using, and they have the encrypted message, they'll not be able to break the message unless they can also get their hands on the key. Hence, the key needs to be sufficiently large such that it can't be easily guessed by an attacker trying keys at random (or by effectively starting at "1" and working his way up.) The size of the key, measured in bits, determines how complex the algorithm is and how tough the code is to crack. The state of the art for encryption technology used exclusively within the United States is 1,024 bits. However, the maximum size key that is allowed to be exported is 40 bits. Bzzzt. The complexity of the algorithm and key size are two different matters entirely. The level of complexity, by the way, typically increases the chance for error (in both algorithm design and implementation) more than adding any levels of security. A secure algorithm doesn't have to be complex. However, its key must be of sufficient length to be "computationally infeasable to break." Let's take the example of a bicycle combination lock. It has a chain which will secure the bicycle to a rack; we'll assume that it's some newfangled sort of chain which is resistant to bolt cutters and all of those sorts of things. The security of this lock now rests in the actual locking mechanism. It's a very simple tumbler lock, perhaps having three or four digits between 0 and 9 that collectively make up the combination. The "key" is the combination in this case. The lock is simple, but it can be difficult to break, if the length of the key is long enough. If there is only one digit, there are 10 possible (10**1) keys. An attacker can quickly guess this and have a new bicycle. However, each time a digit is added to the key, it increases the number of combinations an order of magnitude. Two digits will have 100 possible (10**2) keys, three digits will have 1000 (10**3), four will have 10,000 (10**4) possible, etc. The key size necessary to prevent breaking the solution will depend on your attacker. I mentioned the term "computationally infeasable" earlier. The term simply means that more time and money would need to be spent in breaking the key than the value of that which it locks. If a bike combination has 10**8 (100,000,000) possible combinations, and a thief can try 60 combinations per minute, it would take 165 weeks of continuous attempts to try every combination. By that time, enough lawns could be cut to buy two such bikes. Because computers are binary, we work in bases of two, instead of base 10, which the bicycle combination lock uses, but the principle is the same. Each time you add a digit, you increase the number of keys by an order of magnitude (in a binary system, that means you double it, in a base 10 system, you increase it 10 times.) The key size of your algorithm, therefore, must be large enough to prevent an attacker from having any benefit to recovering that which is encrypted. Keys come in two flavors: symmetrical, or public key model; and asymmetrical, or public key/private key model. Symmetric cryptosystems are sometimes known as "conventional." Asymmetric cryptosystems are known as "public key" ciphers. (Public key/private key *is* the public key model, and an asymmetric cipher!) Symmetric ciphers require the same key to encrypt and decrypt. If you imagine the encryption formula on the left side, and decryption on the right, you apply the same key to both sides in order to encrypt or retrieve the plaintext. Hence, the name "symmetric." Systems which use a different key to encrypt from the key to decrypt, therefore, are asymmetrical. The note about key sizes is also misleading: conventional cryptosystems require a much, much smaller key for security than do public key cryptosystems. Because the math is different, a 128 bit key on a conventional algorithm is roughly the same security as a 2304 bit asymmetric cipher key. The "state of the art" in symmetric cryptosystems is about 128 bits. In this type of system, the government does not allow export of keys greater than 40 bits. Using a 1024 bit key in a symmetric cipher would provide an insane level of security, but would also be very, very slow to use. A symmetrical key uses the same algorithm to encode and decode a message. This is the technique used by the public key encryption program Pretty Good Privacy (PGP). This is wrong, I will explain later. PGP assumes what security experts call the peer trust model. That is, the sender knows and trusts the receiver and is therefore perfectly comfortable in sending the key on its way. Herein lies the "pretty good" part of the privacy. Although the algorithm itself makes the message difficult to crack, the key exchange is only pretty good when compared with other methods. VERY WRONG! I'll explain this also later. On the other hand, the great advantage to PGP is that it creates no key management overhead, which is the biggest drawback of asymmetrical keys. Key management is the biggest problem for the keys of symmetric ciphers, not asymetric ciphers. In the asymmetrical model, users have a public key stored somewhere that is available. Should someone want to send an encrypted message, the sender locates the public key of the recipient, encodes the message, and sends it off. The receiver then uses a private key to decode the message. The private key is different from the public key, but they are mathematically linked so that the private key is capable of decoding the message. Entirely correct. Public/private key exchange is the technique used by RSA Data Security Inc., which was recently sold to Security Dynamics Inc., in Bedford, Mass. RSA uses a technology that is actually an adaptation of the decade-old National Institute of Standards and Technology's peer-trust Data Encryption Standard (DES), still used in many products. DES is a method of grabbing random keys for each encryption task, rather than using the same key repeatedly. Cryptographers say that RSA solves some problems, such as the trust issue but generates others. ACK! NO! RSA is an asymmetric cipher. DES is a symmetric cipher. That's the only difference. How keys are managed is entirely dependant on how the system is implemented. Anything can be assigned a key "at random," by allowing a user's passphrase to be the key. Now it seems like a good time to explain the way that PGP (and Netscape's encryption system) works. Asymmetric ciphers, such as RSA, are very slow. Their key management, however, is very nice and flexible, which is why we like to use them. In a system that requires flexible key management, a high level of security, as well as decent performance, both symmetric and asymmetric ciphers are used. If Alice wants to send Bob a message in such a system (like PGP), she simply composes her message, and tells her mailer to PGP-encrypt the message. PGP will find Bob's public key (either from her key ring, or from a database, perhaps, but it doesn't matter.) The message will then be encrypted with a random SYMMETRIC key (in the case of PGP, it will use the 128-bit-key IDEA cipher). That session key, then, will be encrypted using Bob's public key, and both the session key and message will be sent off (in one PGP encrypted message). Bob will see his mail from Alice, and then his PGP will decrypt the session key, and apply it to the encrypted message, yielding the plaintext: Alice's message. So, in PGP, the MESSAGE is encrypted using a random session key (which is symmetric.) The SESSION KEY, then, is encrypted using the recipient's public key. The rest of the article seems to be generally on track, but certificates and signatures have been confused. A certificate is a cryptographically secure message that states the identify of the presenter. In that way, the analogy to a driver's license is correct. A trusted third party issues the certificate. A digital signature, however, is the cryptographic equivalent of signing your name to something. For example, with PGP, I can digitally sign an email message. PGP does this by taking the message, encrypting it with my PRIVATE key, running the result of that through a secure one-way function ("hash"), and attaching the result to the bottom of the message. A user can then verify that the signature is legitimate by applying my PUBLIC key to the message, and running the result back through the hash, and comparing the two. If they match, the signature is good, if not, something is amiss. (PGP, naturally, handles all of this automatically.) Therefore, U.S. encryption vendors and corporations are forbidden from exporting and deploying versions that use more than a 40-bit key. However, companies in other countries, such as Japan, can freely sell encryption technology that uses the tougher 1,024-bit standard. The two are being confused again. See my earlier note about comparable keys. If you have further questions, please feel free to contact me. If there is interest, I would also be willing to write a series on how to choose a cryptosystem. I am very concerned about the state of cryptographic knowledge in the industry. The area is vital for successful companies' IS departments to understand, and understand well. Yet, the general level of knowledge is abysmally low. I applaud efforts by InfoWorld to increase coverage of this important topic, but I emphasize that the material presented must be correct. Many vendors are currently offering solutions they call secure. Without an understanding of how cryptography works, an IS organization is completely unable to choose between that which is good security and that which is snake oil. A "snake oil FAQ" is being drafted, but is not yet available. In the mean time, there are cryptography FAQs available from ftp://rtfm.mit.edu/pub/usenet-by-group/sci.crypt/ - -- C Matthew Curtin MEGASOFT, INC Chief Scientist I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQEVAwUBMireN36R34u/f3zNAQF+BQf/XD0fPYFuOQsd+u2k4zE1UpfZQKaP+SDw RUhx6R7LnD0ZK5dA+seStvsLl+cvg5tu2wMzf9bniS7taj2DHwmu8MDWYwJPnQST Iiti6XBAoFjCJYWaVghHQzVKw8vxlNC20LzyJ791PdabpUo5ztpf+AXVHGAfWaTg F3ZNYWbbyxg81uxAnKMM/Li6NOKJhcE6nNO+eHUMFLciFki+mz/mOT45fUPs0R9y 4UYLQDvcSVAt246xSufwqbrSY/4dUB3A7KjYvbqWUjYRF/40c1h3K6h69dDnOR/8 SY+AZNnZSzQZbMbHNpjlJ+E71Yz+9Ppvgl6Eeo7oqa+PNeYW0W9GMQ== =PS8M -----END PGP SIGNATURE----- ---------------------------- end response ---------------------------- -- C Matthew Curtin MEGASOFT, INC Chief Scientist I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/

1 0

Re: free speech online
by Blake Wehlage 17 Dec '03

17 Dec '03

At 02:47 AM 9/2/96 EDT, patrick b cummings wrote: >I agree that their should be free speech on the net. Someone should >start a petition and get as many people to sign it as possible. > Patrick.... i have a deal for ya.... you don't write this list for a week? or at least keep the spams to a minimum. Post the hacker requests to a hacker-mailing list (what a concept). Have a nice day! ========================================== Blake Wehlage <jwilk(a)iglou.com> World's Youngest Cypherpunk 2400bps is the net's old people drivers

1 0

Cypherpunk Mailboxes?
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, I have a thought for addressing the anon. problem. We could create a network of anonymous remailers with mailboxes. All messages in the mailboxes are stored encrypted. No information about the users are keep. Users would be be given x K of mailbox space. We could use PGP keys for encrypting the messages. Each user would have his own key pair for his anonymous mailbox. Any plain text messages received to the server would be encrypted on recept. Let the government's subpoena away. :) "Sorry we don't have user addresses, no I can't decrypt those messages Senator." <BEG> What do you think? - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting WebExplorer & Java Enhanced!!! Merlin Beta Test Site - WarpServer SMP Test Site Author of PGPMR2 - PGP Front End for MR/2 Ice Look for MR/2 Tips & Rexx Scripts Get Work Place Shell for Windows!! PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMisGh49Co1n+aLhhAQHvAgP/aLktPSyoj3Ps7OnJ2LXlSIJJQq+B3GiA TlGFJ/DZVF9Ai9rKMzjgmTiukLY/+Hf58vrw7QjJA7wp/fcGOZoYNnMt0mW09wsp biUtXnMkX86sW2abtazy6U3f+DR15lGi9S2F0dvZERmFCdUX5Yi5geoa31Zezght Sj/0sFT+AUk= =7tw/ -----END PGP SIGNATURE-----

3 3

Re: Moscowchannel.com hack
by pjb＠23kgroup.com 17 Dec '03

17 Dec '03

FWIW, not even root can unmount a file system that is busy. -paul > From cypherpunks-errors(a)toad.com Sun Sep 1 18:17:12 1996 > Subject: Re: Moscowchannel.com hack > To: snow(a)smoke.suba.com (snow) > Date: Sun, 1 Sep 1996 10:09:32 -0500 (CDT) > Cc: joelm(a)eskimo.com, Cypherpunks(a)toad.com > Reply-To: ichudov(a)algebra.com (Igor Chudov) > From: ichudov(a)algebra.com (Igor Chudov @ home) > X-No-Archive: yes > Organization: Bool Sheet Software > X-Mailer: ELM [version 2.4 PL24 ME7] > Content-Type> : > text> > Sender: owner-cypherpunks(a)toad.com > Content-Length: 689 > > snow wrote: > > > > On Sat, 31 Aug 1996, Joel McNamara wrote: > > > > > Not really crypto, but related to the DOJ hack in a way. > > > > > > Moscow Channel is a pretty slick, Russian news/commentary page. Their Web > > > site was hacked and altered by someone who didn't seem to like Russians all > > > Just a matter of time before some builds a dedicated Satan type tool that > > > scans for HTTP server holes or messed up file permissions to make locating > > > potential victims easy. > > Write your web site to a CD-ROM and hard-code the base directory into the > > webserver. > > A hacker who has root can forcibly unmount the cdrom and mount another > directory on that node. Not a good solution. > > - Igor. >

2 1

desubscribe
by Brett Eitland 17 Dec '03

17 Dec '03

desubscribe

1 0

desubscribe
by Christopher Carper 17 Dec '03

17 Dec '03

desubscribe

3 2

Re: Sharp Knives
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:38 PM 9/2/96, Dave Harman OBC wrote: >In California, it's a felony to merely *own* a Ninja star. It's a >felony to carry a *concealed* knife, but carrying it openly in a >holster is legal. It's a felony for most people to carry a >concealed loaded handgun on the street only on a *second* offense. >It'a a felony to merely *own* a switchblade, brass knuckles, etc. >Do our weapons laws sound strange? Are many of our weapons laws >stricter than countries like Sweden? Yes! Most laws about knives, dirks, daggers, brass knuckles, saps, etc. were devised to control the coloreds, who could not afford the weapons of choice of whites and other gentlemen. Hence, a colored who gets picked up on some charge, or detained, can be jailed on a felony charge for having a pocketknife, or a sap, or brass knucks. Coloreds from Asia can be jailed for having the martial arts sorts of weapons. A white gets a misdemeanor charge for carrying a gun. (This analysis is not original with me. The gun magazines have noted the racist origins of misdemeanor/felony dichotomies for many years. One article I read a few years ago traced the precise times at which these laws came into being...mostly the times in various states corresponded with periods of high immigration of coloreds to major cities.) Here in California there's a bill pending in the legislature which would decriminalize the carrying of a pocketknife that can be opened with one hand (a la the Spyderco, Benchmade, Buck, Cold Steel, etc., knives with thumb holes or studs). Even though such knives are openly sold in every sporting goods store I have ever been in, and are carrried by a truly large fraction of the population, such knives are currently classified as "switchblades" and can be prosecuted as a felony. A good way to selectively harasss someone. Interestingly, it was the District Attorneys lobbying group in California which made the difference: they argued that such laws are unenforceable or are selectively enforced. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Censorpore as a Terror State
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:29 AM 9/2/96, Bill Stewart wrote: >While Tim's article title was clearly intended to be provocative, Indeed, I write many things to be _provocative_. Not to be insulting, but to challenge orthodoxies. And when I hear mealy-mouthed platitudes along the lines of "foreigners do not understand the special needs of our nation, and do not understand why Benevolent Father Yew channels our thoughts in more productive directions," I have to call a spade a spade. (quoting James Seng) >>In addition, you need to see the method of censorship deployed in >>Singapore. For press media like papers and magazine, it is done in a >>passive manner. They _do not_ read every issue of every magazine available >>in Singapore. They only do so when there is enough complains. > >This also means you don't know what is safe to print and what isn't. >You have to restrict yourself very strongly, because otherwise >some politically influential person will complain to the government, >and you go to jail. At least if the government tells you what >the rules are, you know it's safe to say things that don't violate them. Yes, what James Seng calls a "passive manner" is often worse than censorship in a direct manner. Psychologists would mention "random reinforcement" at this point. When there is _direct_ censorship, with clearly defined rules, publishers will skate as close to the edge of the envelope as they can, and even test the limits. When there is _passive_ or _vague_ censorship, with rules not carefully spelled out but with the possibility of prosecution and jail time always looming, then publishers and others will rein themselves in, taking the cautious route. This is, of course, often the result desired, that people invoke "the policeman inside" (to use the Burroughs term). This is really the essence of a "terror state." The rules are not known, the fear of a knock on the door is omnipresent, and the Beloved Ruler may dispatch his enforcers on a whim. >>ps: Sorry for the off-topic discussion. > >It's not off-topic. Building tools to prevent censorship is >distinctly on-topic for cypherpunks, and an occasional digression into >whether it's a good idea is worthwhile. Exactly. A discussion of routing-around Censorpore's policies is at least as on-topic as the 17th discussion of some snake oil cipher. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

National ID Card Web Pages
by Dave Banisar 17 Dec '03

17 Dec '03

EXTENSIVE NATIONAL ID CARD WEB SITE IS NOW ON LINE The London-based human rights watchdog Privacy International (PI) has just opened an extensive web page on National ID cards. The initiative comes in the wake of pending efforts in the United States, Canada and United Kingdom to implement national ID card systems. The page contains a 7,000 word FAQ (Frequently Asked Questions) on all aspects of ID cards and their implications. Also included in the PI documents is a paper describing successful campaigns opposing to ID cards in Australia and other countries. The page also has links to numerous other sites and documents. PI Director Simon Davies said he hoped the page would help promote debate about the cards, "ID cards are often introduced without serious discussion or consultation. The implications are profound, and countries planning to introduce them should proceed with caution." "The existence of a card challenges important precepts of individual rights and privacy. At a symbolic and a functional level, ID cards are often an unnecessary and potentially dangerous white elephant. They are promoted by way of fear-mongering and false patriotism, and are implemented with scant regard for serious investigation of the consequences." he said. The URL is : http://www.privacy.org/pi/activities/idcard/ PI has also set up an auto response function for the FAQ document. Its address is: idcardfaq(a)mail.privacy.org Privacy International is an international human rights group concerned with privacy and surveillance issues. It is based in London, UK. For further information contact the Privacy International Washington Office at +1.202.544.9240 or email pi(a)privacy.org. PI's web page is available at: http://www.privacy.org/pi/ _________________________________________________________________________ Subject: National ID Card Web Pages _________________________________________________________________________ David Banisar (Banisar(a)privacy.org) * 202-544-9240 (tel) Privacy International Washington Office * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.privacy.org/pi/ Washington, DC 20003

1 0

Modem tax again?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

As I recall, the alleged "subsidy" consists of lack of payments so rural areas can have subsidized phone service - thus making their costs borne by everyone else. -Allen > _________________________________________________________________ > Avis > _________________________________________________________________ > INTERNET IS HURTING PHONE NETWORKS, STUDY SAYS > __________________________________________________________________________ > Copyright &copy 1996 Nando.net > Copyright &copy 1996 San Francisco Examiner > SAN FRANCISCO (Aug 27, 1996 3:11 p.m. EDT) -- Hoping to reduce or end > a subsidy that has kept down the cost of on-line service, local phone > companies here have presented the Federal Communications Commission > with studies arguing that Internet users are overtaxing phone networks > and ought to pay more for monthly service. > The studies, one of which was published on the Internet, argue that a > 13-year-old subsidy lets Internet service providers (ISPs) pay a > fraction of what a long distance company pays to get a phone line, > even though Internet calls may use more phone system capacity than > voice traffic. [...] > For their part, ISPs are alarmed at the remote possibility that the > FCC might let phone companies raise their monthly costs from the > current monthly average of $30 to anything approaching the $600 that > some long distance carriers pay for a phone line. > "If we had to pay anything like long distance access charges, it would > put all the ISPs out of business," said Ronald Plesser, the > Washington, D.C., attorney who represents the Commercial Internet > Exchange, an ISP trade group. > FCC staff attorney Kevin Werbach said the subsidy began in 1983, when > the five-member federal commission created a special rate to encourage > the growth of on-line services, voicemail companies and other emerging > industries that offered enhanced electronic services over phone lines. > In 1987, the FCC considered ending the subsidy but backed down after > public protest over what came to be characterized as the "modem tax." > Given the growth in on-line usage, ISPs assume any talk of ending the > subsidy would create a bigger backlash today. > "There are a minimum of 20 million and perhaps as many as 40 million > on-line and Internet users and many of them are registered voters," > said William Schrader, president of PSI Net, an ISP in Herndon, Va. > Schrader said when he visited several FCC members recently, he > suggested that many of those users would be happy to send a letter of > protest to FCC Chairman Reed Hundt. [...] > Copyright &copy 1996 Nando.net

1 0

The Earliest CP Remailer *DID* Emphasize Anonymity
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:22 AM 9/2/96, Bill Stewart wrote: >>From what I know of remailer history, the main original goal >of the cypherpunks-style remailer was to provide >security against traffic analysis by eavesdroppers, rather than to >prevent the recipient from knowing the sender's address, though >everybody pretty quickly realized that the latter was an interesting >feature, especially coupled with posting to Usenet. No, the focus was at _least_ as much on providing anonymity as on protection from eavesdroppers or traffic analysts. More so, actually. How do I know this? Well, I was the one who did the presentation on Chaumian mixes at the first meeting, describing them as remailers and using paper envelopes-within-envelopes to illustrate the concept. Later that day, in the "Crytpo Anarchy Game" we played to educate the attendees, remailers were used to post anonymous offers of goods and services, to make contact in message pools, and to generally implement a crypto-anarchic, distributed system. (With some obvious flaws, stalls, and other weirdnesses.) Still, it embodied most of what we see today (and a lot more that we still haven't managed to implement). The next afternoon, Hugh Daniel, Eric Hughes, and I went out for some bagels and talked about what had been learned. Either Hugh or Eric had the idea of coding up the remailer in C or Perl. As it turned out, Eric was the one to do it, a few weekends later, using Perl (which he learned enough of on Saturday to then do on Sunday). The first remailer was put for use and immediately began to be used for anonymous postings. And all of the early uses were explicitly to anonymize the sender, not to deter eavesdropping (which conventional crypto works well for, anyway). The Kleinpaste-style remailer was in a nascent stage, and Julf was running one on his site. But we all knew the longterm advantages of chained remailers, and, of course, even the very first Hughes remailer supported arbitrary chaining. And we also knew of the central defect of the Kleinpaste-style anonymizer, that law enforcement would seek the records through subpoena. As it turned out, penet lasted longer than I for one thought it would. PGP encryption was added soon after to the Hughes-style remailer, by Hal Finney, as I recall. Later developments, by Matt Ghio, Lance Cottrell, etc., added to the capabilities. So, the anonymizing and arbitrary chaining (which is for protection against collusion of the remailers and subpoenas of logs) features were there from the start. Even before the start, as the "Crypto Anarchy Game" had them. (I've been clear that it was Eric Hughes who coded the first Perl version, but I feel I have to make my own role clear. There are some critics of me here on this list who have claimed "Tim has never done a thing for Cypherpunks except talk." Well, besides organizing the first meeting with Eric, and giving the morning talk on the topics mentioned, and demonstrating the role of mixes and digital cash, and writing articles on many topics, and setting up BlackNet (which actually works, and is not just an idea), and on and on, I'm satisfied with my contributions. Your mileage may vary.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Sharp Knives
by qut＠netcom.com 17 Dec '03

17 Dec '03

! How do these Ninja stars work anyway? ! ! I've heard about them, but do not know much. I don't know either, they're as illegal to own as it is to rip off a car!

1 0

EFF chairwoman: Anonymity proven not to be a positive factor
by um＠c2.org 17 Dec '03

17 Dec '03

>From a Scientology magazine: Esther Dyson, member of the board of directors of the Electronic Frontier Foundation and member of the National Information Infrastructure Advisory Council, spoke on the anonymity issue at the fifth Computers, Freedom & Privacy (CFP) conference in San Francisco. [...] "I have a concern about the spread of bad behavior on the Net," said Dyson. "Anonymity figures into this, and I feel that it has proven to not be a positive factor. It breaks down the community which we are seeking to build, and cout protection and privacy laws already exist and should be applied in a broad way, such that they are transparent to new wrinkles in the technology. It is not necessary to view the world of the Net as different from the rest of the world." http://www.anonymizer.com:8080/http://www.theta.com/goodman/hijack.htm [For EFF's former position on anonymity, see http://ftp.sterling.com:80/COAST/doc/law+ethics/EFF-Anonymity]

2 1

Re: Encourage Singapore To Come Out Of the Stone Age
by Arun Mehta 17 Dec '03

17 Dec '03

At 19:13 02/09/96 +1000, James Seng wrote: > > What i am saying is that Asian (Singapore) >values are _DIFFERENT_ from western (America) values. [i know i am generalising] > >When you look at the laws and regulation. You cannot just look at what you >think is best. You have to look at other things. Culture, social and >economical structure, religion and history. In every aspect, Singapore (or >most Asian for that matter) are different. Thus, you cannot judge a >Singapore government action based on your social background. I've been reading some of the postings on singapura.singnet.com.sg: quite a few people in Singapore are pissed off that they have to go through the proxy. So, not everyone in Singapore thinks as differently from those of us who oppose your government's action as you would have us imagine. Look, if the government had said, "those who wish to avoid smut on the Net, go through this proxy, but those who do not wish our guidance can do as they please," we would not be having this discussion. What we have a problem with is the government trying to *force* on everyone its own judgement on what is appropriate. People like you in Singapore are responsible, thinking adults. Surely you can make the choice yourself on whether you wish to accept government guidance in this or not? > >Sad to say, Singapore government does have a lot of power. But i am glad >what you mention isnt happening in Singapore. I havent heard of any serious >corruption cases or people accepting bribes etc. Nor does the people here >feel a suppressed nor are there general disatifaction. I think you are too >influenced with the persepection from 1984. *8) In 1975, Indira Gandhi imposed a totalitarian regime in India. The newspapers only carried news about how happy everyone was with the controls. Lulled into complacency, Mrs. Gandhi called elections, partly to make everyone shut up. What happened? She was soundly defeated. Moynihan, a former US ambassador to India, remarked, "Politicians rarely like what they read about themselves in a free press, but it can save their skin." Or words to that effect. Maybe, just maybe, there is far more corruption in Singapore than you think, but that you have no way of finding out without a free press? Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

1 0

new-thinking mailing list tidbit; Singapore slings
by P. J. Ponder 17 Dec '03

17 Dec '03

keywords: thought police; mind control; Stone Age; cluelessness; Island nation; why are remailers bad? the mailing list 'new-thinking' has an interesting piece in the current issue, speaking of on-line communities of interest. the archive is at: ******************************************************************** For a hyperlinked version of this piece, please go to: http://www.nua.ie/NewThinking/Archives/newthinking011/index.html For New thinking archives, please go to: http://www.nua.ie/NewThinking/Archives/index.html ******************************************************************** +++++ sounds like the Singapore brainwashing is working pretty well if their educated people are opposed to even a discussion of whether free speech is a good thing or not. Yikes. It isn't a cultural thing, pinhead. Get life, government goon. Free speech is the right to say things others - even a _majority_ or even the government - may find unpopular. And you can tell your fascist dictator I said so. -- P.J. Ponder OBCrypto: for a keyed-SHA signature system, is there an advantage to pre-pending the keystring as opposed to appending it? I think I read something about this in one of Hugo Kracyk's (sp) papers about a keyed-MD5 system, but now I can't find it. If I recall correctly, he explained why it was better to put the key part in the beginning, instead of the end.... Thanks for any help. [Anti-Dyson and anti-EFF rant left off for now. waiting for more responses from EFF et al. Was nice to get a reply from Esther Dyson. Didn't change my mind about anonymity being a good thing, though. It will be interesting to see what Julf gets back from his survey of why people are opposed or in favor of anonymity.] [See the web page listed in the press release from penet.] I looked at the FTP, Inc. software site referenced here a few days ago for the email package that integrates PGP. Pretty hefty package to ftp over a 28.8 dialup. The write-up on the web page looked good - I'll ftp it at the office over the T1 if I can and see what it does. I assume it blows up after the 30 days (or whatever the trial period is)?

1 0

Re: DON'T Nuke Singapore Back into the Stone Age
by Arun Mehta 17 Dec '03

17 Dec '03

At 15:18 01/09/96 -0700, Rishab Aiyer Ghosh wrote: >Arun Mehta wrote: >> and India will be too: the law here holds the ISPs responsible >> for ensuring that nothing objectionable and obscene is carried by >> them, and what simpler way to comply than to > >FWIW: "There is no need to licence content providers; Internet >service providers are not responsible for illegal content." R K >Takkar, Indian Telecom Secretary (at the time of interview) What Mr. Takkar says isn't law, plus he's gone. The law clearly holds ISPs responsible for content: when it suits the government it will pull it out. Doesn't even have to be the government: some headline-seeking opposition politician could take the government to task because the government-run ISPs aren't complying with the law. And please don't get lulled into complacency by a stupid law that isn't being enforced: in 1975, Indira Gandhi pulled out a host of them to *legally* impose dictatorship. >> Ideally, I should be able to >> send via pgp and anonymous remailer a request for a page, which would soon >> come beamed down unencrypted via satellite. No more waiting hours >> for the latest version of Netscape to download > >(!) you'll only have to wait hours for your anonymous-remailer-web-to-e-mail >gateway, EVERY time you want a page. every time I want a BANNED page -- I'd say it's worth it. In the process of accessing it, I also show it to everyone in Asia, thus giving the banned stuff much more publicity than it otherwise would get on the net. >governments will >eventually see sense and stop censorship, if they're interested in >making their countries rich. Singapore in every other field of work >has shown its interest in deregulation; I would expect them to do so >on the Net as well, when it becomes clear that there's rather more to >it than porn and subversion. Governments everywhere (see Declan's long list) seem to think they can separate out the porn and subversion from the "rather more". Just as in the German case, where the Zundel-site was mirrored so that Germans could access it, external measures to help Singaporeans access what they like would certainly help their government "see sense." >In the meanwhile, there's not much point >trying to "help" them, apart from providing moral support. Guess I'll risk being accused of indulging in cliches when I cite the famous Niemoeller quote once more which begins, " First they came for the communists, and I did not speak out, for I was not one"... and ends "And then they came for me. There was no one left to say anything..." Freedom is won and lost in inches, and you have to fight every single inch they try to take away. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

1 0

Re: Silenced Machine Guns Are Safer Than TWA
by qut＠netcom.com 17 Dec '03

17 Dec '03

tcmay(a)got.net (Skippy) wrote: ! At 4:33 AM 9/2/96, qut(a)netcom.com (Net God) wrote: ! ! >Contrary to popular fiction, ALL firearms have been permanently ! >registered since the 1968 Gun Control Act. The media monopoly lies when ! >they say the contrary. ! ! Nope. Gun sales between individuals without any paperwork were fully legal ! in some places until recently (and may still be fully legal...I can only ! speak of California). So? I was talking about NEW sales of firearms from license holders. Let's consider improving the future rather than preserving the past, shall we? ! >From 1974 until a couple of years ago, I bought and sold a dozen or more ! rifles, handguns, and even Evil Assault Weapons, mostly through fully legal ! gun shows. I even sold a .357 Smith to some guy, made a joke about how ! great these gun shows were and how great it was to be able to just take ! cash and hand over a gun without any paperwork...the guy laughed and said ! he was a San Jose cop. I felt nervous for a few seconds, but quickly ! realized there was no law *I* was breaking, so I laughed too. ! ! Most of these guns I kept no records on, nor did any laws say I had to. ! ! (A few years ago it became necessary for even private citizen-units to ! obtain the proper firearms transfer papers from the gubment. I wanted to ! sell a laser-equipped Heckler & Koch SP-89 without creating a paper trail ! (as I'd not had one when I acquired the piece a few years earlier), so a ! friend of mine used his friendly neighborhood libertarian FFL dealer, who ! has a policy that the stack of transfer forms he is required to keep on ! file will mysteriously burn up if the Feds ever seek out his records. (Who ! knows if he'll abide by this policy, but the point is that there are ! literally tens of thousands of these "kitchen table FFL dealers," and no ! computerized filing of records. This is one reason I quit the NRA: they are ! advocating the "instant check." Such an instant check would mean massive ! computerization of all files, and of course cross-referencing to files on ! citizens. This would be much worse than the "paper chaos" of stacks of ! firearms paperwork sitting in dusty filing cabinets. I'll take a 10-day ! ineffectual waiting period to a Big Brother database of all purchasers.) So you'ld prefer the security of obscurity? I'd prefer to have much more government protected rights, openly. Do you belive the civil courts have a role in protecting people's rights? If so, then "government protected rights." ! >BTW, I muse that the issue of guns, drugs and censorship make an ! >excellent litmus test for libertarians: either you support the ! >legalization of, all of, or your a fake. ! ! I'm not sure what the "legalization of censorship" would mean, though I ! support the right of anyone to screen out what they choose not to read or ! view. And I support the right of companies to decide what materials to buy, ! have viewed by employees, etc. (So if the "Valley Lesbigays" want to show a ! tape at Hewlett-Packard, H-P can just say "Nope--we're not interested.) ! ! I fully support legalization of all drugs, all guns, and am unalterably ! opposed to any form of government censorship. I meant the good side of the censorship issue! But I also support enforcement of the anti-trust laws, so some would view the court enforced break up of illegal collusion of the media to crush competition as "government censorship."

1 0

Too few nymservers
by nobody＠replay.com 17 Dec '03

17 Dec '03

On Sun 1 Sep 1996 Dave Harman OBC wrote : [snip] > There has to be more crypto anonymizing aliasing remailers and with > easier interfaces. Closing the Kleinpaste derived server will help > put the pressure of demand to start better remailer systems. > There's not enough capacity and reliability with the servers extant. > There should be thousands of full featured remailers. Exactly. Sometimes *all* the nymservers are down at the same time.

2 1

Pseudocrypto detector is going wild (was: Re: ALPHACIPHER - An unbreakable encryption program.)
by C Matthew Curtin 17 Dec '03

17 Dec '03

The following message is a courtesy copy of an article that has been posted as well. -----BEGIN PGP SIGNED MESSAGE----- "Alex Walker" <survival(a)aa.net> writes: > The strongest encryption system available to the public will be available > soon at: > http://www.aa.net/cyber-survival-hq > > ALPHACIPHER has been in the making for the past ten years, and has come > into its own > with the proliferation of Internet communications. > > A demo of this program along with a FAQ can be downloaded from > cyber-survival-hq 1SEP. This is an unbreakable program... Here we go again. I just got done surfing the site above. Assuming that all statements regarding the unbreakability of the cipher, the lack of applicability of the question regarding its key size, etc., are at least based on some degree of truth, "alphacipher" is a one-time pad. Given that anything else is not really "unbreakable," if it's not a one-time pad, the claims about its security are bogus. But let's assume that it is. In exchange for the great security of one-time pads, users of such must be willing to tolerate their drawbacks, and there are some significant ones. 1 The unbreakability of the one-time pad is completely thrown out the window if the key is not _truly_ random. A software based pseudorandom number generator simply won't cut it; even the best PRNGs will have some degree of predicability. It is possible that these random keys are truly random (given point 2, below), but I find this to be unlikely, since the overview boasts that the keys are generated by a "proprietary random key set generator." Now, we're getting into *another* issue, and that is of the wisdom (or, more correctly, lack thereof) in using proprietary algorithms. Not only does this fail to ensure any higher level of security when compared to that of a well-known algorithm, but actually increases the liklihood that an error has gone undiscovered, since fewer experts have had the opportunity scrutinize it. 2 The pool (or "pad") of random bits from which the keys are generated must be distributed ahead of time. Given this requirement, the "random bit pad" must be distributed with the program itself. In fact, the two "comm key disks" seem to be just this. A third "vault key" disk, used for local online storage, seems to be another random bit pad. 3 Keys must stay perfectly in sync. A single bit-shift either way, and you're hosed. Given that there is a finite number of bits in the pad (as there must be, since they need to be precalculated and distributed with the program), that they all must stay perfectly in sync, and that the program appears to be marketed for widespread (albeit low-bandwidth) use, there must be some mechanism by which the encrypting program can tell the decrypting program how far along in the bit pad to advance before using them for the key. Otherwise, if I send a message to Alice, then I send one to Bob, Bob is going to use a different starting point in the pad for the key assembly than I did to create the message, unless he also received a copy of what I sent Alice, and every person before that. Giving an indication of the byte offset to use for decryption seems the only workable solution to this problem. 4 The keysize must be exactly equal to the size of the plaintext to be encrypted. 5 Bits from the pad that are used for key generation must never be used again. Ever. Since there are only two "comm key" disks, which must be the same for every distribution, you can get probably get somewhere between two and 10 million "random" bits on the disks, depending on whether you're using compression, and if so, what compression algorithm you're using. Let's assume that you've got 10 million bits on there. Since the encryption of one bit exhausts one bit from the pad, I can exhaust the entire supply by sending someone a 10MB mail message. Or two five MB mail messages, or 10 one MB messages. In any case, it doesn't take long. And as soon as I'm out, if I start over again at the beginning, I'm blowing the security, since I'm reusing keys. 6 Anyone with access to the key pad can decrypt a message sent to anyone else, as long as they know the proper bit offset. Because of what I've described in item 3, it seems likely that I'll know that ahead of time. Hence, the security of the "alphacipher" encrypted messages decreases with each additional user that "alphacipher" gains. So, it seems to me that I can break *any* message that anyone encrypts with "alphacipher" by getting a copy of the comm key disks, figure out how "alphacipher" calculates where in the pad to begin generating the key, and apply the appropriate key to the encrypted message. Perhaps a bit of additional obfuscation is occuring somewhere in there, but the basic premise is that because of what it's trying to do, this has to be a very poor implementation of a one-time pad, and therefore completely vulnerable to passive attack. (This is using the "comm key"; the "vault key" has much more potential, since it can be unique for every user, but it can still be exhausted very quickly, and therefore have a successful cryptanalysis made of that data, using other means: a larger amount of data will be necessary to reconstruct the bit pad before any messages can be broken, but once again, after it's constructed, anything encrypted using that bit pad can be broken. And, since it seems unlikely that we're dealing with REAL random numbers here, this probably isn't nearly as tough as it ought to be.) I have absolutely no knowledge of "alphacipher" beyond what is contained in the original posting I saw on alt.security which pointed me to the web page (http://www.aa.net/cyber-survival-hq/Alpha1.htm) but it seems that I've made a decent (albeit trivial) analysis of its weakness, and at least given serious raise to your ability to make such claims about its security. If I'm wrong, please show me how so. If not, please do us all a favor and quit with the advertising claims. (All I need now is someone to threaten to sue me, and I'll maintain my record of having lawsuit threats made against me every time I criticize something that claims to be "strong crypto.") - -- C Matthew Curtin MEGASOFT, INC Chief Scientist I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQEVAwUBMisu2X6R34u/f3zNAQFKSgf/T/cB0X33sDGHoiqVfbXZcW9VEFBcbtVA bTjFLEKrh89pEeZ8VR7FsZRkbC5C7ceuy1aoTAK+RLdaOBZN8AkOTWXvo139gVW/ 9P+gv8eitZlhWzSnXfpURp45m737wjRfgsP7drgWZr3AdGCu3XOipIyy3tcJrcGY fPBpBZXvAfdmxX5B3CiRgLFOdhVxzhyO7Cv019ybRTCYjZncPEyyXIYMzrCJkyBi QbZzcsvgwTq+vD0Cw9/REVqxH6Av3tzJacLLgo33hO1cvti9910FcTSCIdnmR+E+ Pse2Gm0nx8Ochcfw2ZmEVtJI7hXkLbOXMq7i/i++jtMSeMVrIsfXUg== =ZbJf -----END PGP SIGNATURE-----

2 1